Transaction flow networks are crucial in detecting illicit activities such as wash trading, credit card fraud, cashback arbitrage fraud, and money laundering. \revise{Our collaborator, Grab, a leader in digital payments in Southeast Asia, faces increasingly sophisticated fraud patterns in its transaction flow networks. In industry settings such as Grab's fraud detection pipeline, identifying fraudulent activities heavily relies on detecting dense flows within transaction networks. Motivated by this practical foundation,} we propose the \emph{\(S\)-\(T\) densest flow} (\SDMF{}) query. Given a transaction flow network \( G \), a source set \( \Src \), a sink set \( \Dst \), and a size threshold \( k \), the query outputs subsets \( \Src' \subseteq \Src \) and \( \Dst' \subseteq \Dst \) such that the maximum flow from \( \Src' \) to \( \Dst' \) is densest, with \(|\Src' \cup \Dst'| \geq k\). Recognizing the NP-hardness of the \SDMF{} query, we develop an efficient divide-and-conquer algorithm, CONAN. \revise{Driven by industry needs for scalable and efficient solutions}, we introduce an approximate flow-peeling algorithm to optimize the performance of CONAN, enhancing its efficiency in processing large transaction networks. \revise{Our approach has been integrated into Grab's fraud detection scenario, resulting in significant improvements in identifying fraudulent activities.} Experiments show that CONAN outperforms baseline methods by up to three orders of magnitude in runtime and more effectively identifies the densest flows. We showcase CONAN's applications in fraud detection on transaction flow networks from our industry partner, Grab, and on non-fungible tokens (NFTs).
Blockchain technology and cryptocurrencies have attracted significant attention in recent years, yet remain susceptible to cyber threats such as phishing attacks. Existing detection approaches often suffer from high computational costs and limited robustness, especially when facing varying data distributions and sparse structures. To address these issues, we propose Robust, Node behavior, Transaction structure, and Network (R-NTN), a detection framework for Ethereum phishing accounts that leverages multi-dimensional transaction features. R-NTN first constructs 2-hop ego graphs via random walks, then extracts features from three complementary dimensions: behavioral attributes, transaction-based structural features, and network embeddings. These features are integrated into a unified representation for downstream classification. Experiments show that R-NTN consistently outperforms baseline methods and maintains high accuracy across datasets of different scales and compositions, demonstrating strong robustness and generalizability.
Decentralized Finance (DeFi) has changed the financial ecosystem but is extremely vulnerable to complex schemes such as rug pulls, honeypots, and flash loan attacks, which cause massive losses for platforms and users. This study responds to the critical necessity of early and actionable warning for fraud by suggesting a real-time system predicting and justifying the risk level of freshly launched DeFi tokens prior to their engagement with the users. Drawing on a hybrid methodology, integrating smart contract code analysis, on-chain behavioral data, and social metrics, the system utilizes cutting, edge machine learning models, including Graph Neural Networks (GNNs) and ensemble methods (XGBoost, FT-Transformer), to provide sophisticated risk scoring. For user and regulatory trust assurance, explainable AI methods such as SHAP and LIME are utilized to clearly identify important risk drivers, including unsafe contract functions, wallet concentration, and liquidity lock patterns. The solution provides stage-aware and cross-chain surveillance, coupling functionality like anomaly detection, federated model training, and governance analysis. With large-scale literature synthesis and empirical validation, this framework shows that proactive, pre-transaction fraud identification and open risk valuation are possible, and it achieves a scalable defense for DeFi players and infrastructure.
Santhi V, Simrithaa N V, Dhanaseelan V, Arul Arasu N ¡ 6 authors
The prevalence of fraudulent activities in the insurance industry is alarmingly increasing and requires innovative solutions. The primary objective of the research is to identify instances of fraudulent insurance claims through machine learning algorithm and develop an efficient storage system of the insurance claims, which is secured, private and suitable for the industry. The XGBoost model with SMOTE oversampling is proven to be distinguished among other models. Hyperledger Fabric, a permissioned ledger is used to store and retrieve the insurance data, ensuring the reliability, immutability and authorization. To protect the data from public visibility, zero knowledge proof technology is utilized. This ensures the privacy and authenticity of the information. Overall, this research provides an efficient and automated claim validation system with higher accuracy and efficient storage in blockchain while preventing information leak.
Detecting fraud in digital banking is a recognized challenge given the increasing sophistication of perpetrators as well as the limitations of traditional security models. Rules-based systems produce interpretability but cannot be adapted to emerging fraud threats. Advanced machine learning models require complex systems for training and serving, which are often not practical in lightweight and real-time environments. In this work, a Java-based Hybrid Framework for Fraud-Resilient Banking Systems is built that combines rule-based compliance, lightweight AI modeling, anomaly detection, and the application of cryptographic concept of Zero Knowledge Proof (ZKP) authentication in a decision layer. A synthetic dataset of 10,000 banking transactions representing realistic imbalances has been developed, with approximately 0.6% flagging transactions as fraudulent. The rules for interpretable transparency are applied in the event of high-value transactions or merchant transactions that are shown to be suspicious, the fraud detection is tackled through a logistic regression classifier to apply a probabilistic approach to fraud detection and z-scores have been used to identify anomalous outliers from an expected normal distribution as fraud. The framework included Schnorrâs ZKP protocol to authenticate the user without disclosing the secret credential. The consolidated scoring system incorporates the outputs of rules, AI probabilities, anomalies, and ZKP verification for sorting transactions into High, Medium, and Low risk. The experimental results on the Java implementation shows an achievable ROC AUC of 0.984. The system produces a balanced risk distribution, for 1.8% of transactions classified as high risk, 20% medium risk and 78% low risk. This research suggests that a lightweight Java-based fraud detection system can be made efficient, interpretable, and cryptographically augmented, and thus usable in practice for a banking platform where performance and security are key.
Ahmed Abbas Jasim AlâHchaimi, M. A. Khalifa, Walid ElâShafai
ABSTRACT Blockchain networks now support billions of dollars in daily transactions, making reliable and transparent fraud detection essential for maintaining user trust and financial stability. Yet, realâworld blockchain datasets are extremely imbalanced, with fraudulent activity representing less than 1% of all transactions. This imbalance causes conventional machine learning models to achieve deceptively high accuracy while still failing to detect a substantial portion of fraudulent events. To address this challenge, this study evaluates the performance and explainability of three modelsâXGBoost, LightGBM, and Decision Treeâon the Ethereumâbased fraud detection data, in which 58% of transactions are identified as fraud. The methodology combines vast feature engineering, kâfold crossâvalidation, and assorted resampling approaches, such as Synthetic Minority Oversampling Technique (SMOTE) and Adaptive Synthetic Sampling Nearest Neighbor (ADASYN), to revise the effect of class mismatch. Accuracy, AUC, recall, precision, F1âScore, and Matthews Correlation Coefficient(MCC) are used to measure model performance, and SHapley Additive exPlanations (SHAP) is utilized to give global and local interpretability. Experimental results show that XGBoost combined with SMOTE or ADASYN yields the strongest performance, achieving a recall over 99%, an AUC of 1.000, and a substantially improved MCC compared to training on the raw imbalanced data. LightGBM presents a favourable precisionârecall balance, and Decision Trees demonstrate significant gains after resampling, despite their simplicity. SHAP analysis reveals that logâtransformed transaction amount, merchantâbased encoding, geographic encoding, and temporal features are the primary contributors to fraud risk. These results are important in highlighting two implications: (i) the importance of dealing with extreme class imbalance, rather than choosing increasingly sophisticated approaches, and (ii) the ability to be trusted to be explained is a requirement of responsible working in both financial and blockchain settings. The research offers a pragmatic, interpretable framework on blockchain fraud detection and future directions, including sophisticated hybrid sampling, collective learning, as well as crossâchain generalization to enhance fraud detection in distributed systems.
Smart contracts have become the backbone of decentralized ecosystems, managing billions of dollars in assets across applications ranging from Decentralized Finance (DeFi) to digital governance. Given the immutable and autonomous nature of blockchains, the security of these contracts is paramount. A single vulnerability can lead to catastrophic and irreversible financial losses. However, despite these high stakes, a significant gap exists in understanding how developers utilize exception-handling mechanisms to enforce correctness and the specific types of logic flaws that arise from their misuse. This thesis aims to enhance smart contract security through comprehensive studies, beginning with an empirical characterization of defensive programming practices, followed by a systematic analysis of associated faults, and finally, the proposal of a novel vulnerability detection framework. It consists of the following three studies. The first study focuses on the fundamental safeguards of contract logic: state-reverting state-ments (i.e., require, revert, and throw). While these statements serve as the principal mechanisms for exception handling in Solidity, there is a lack of empirical understanding regarding their prevalence and usage patterns in the wild. To address this, the study conducts the first empirical study across thousands of real-world contracts. The results reveal that these statements are pervasive, appearing even more frequently than general-purpose if statements. The analysis further demonstrates that developers primarily use these statements to perform seven types of authority verification and input validity checks. This study establishes an understanding of how developers intend to secure contract logic. The second study investigates the landscape of faults arising from the improper use of these state-reverting statements. Although developers rely on these statements for security, incorrect implementation results in subtle bugs that traditional testing often misses. To understand these failures and benchmark detection capabilities, this study constructs the first comprehensive dataset of 320 real-world faults, curated from open-source project histories and security audit reports Through manual analysis, the study derives a taxonomy of 17 distinct fault types and distills 12 common fixing strategies. A subsequent evaluation of 12 state-of-the-art security tools against this benchmark reveals an average detection rate of only 14.4%, highlighting that existing tools are ineffective at identifying these critical logic flaws. The third study addresses the limitations of existing approaches in identifying high-level semantic vulnerabilities, specifically Price Manipulation. As indicated by the second study, traditional tools struggle with logic flaws because they often lack the ability to interpret complex economic context. To bridge this gap, this study proposes PMDETECTOR, a hybrid framework designed to proactively detect price manipulation. The framework employs a three-stage pipeline to model economic semantics: (1) static taint analysis to identify potentially vulnerable paths, (2) a two-stage Large Language Model (LLM) analysis to filter effective defenses and simulate exploitation, and (3) a final static checker to validate findings. Evaluated on 73 vulnerable and 288 benign contracts, PMDETECTOR achieves up to 100% precision and 88% recall, with GPT-4o achieving a state-of-the-art F1-score of 0.91. Furthermore, in a large-scale scan of over 8,000 recently deployed contracts, it identified 4 previously unknown vulnerabilities, confirming its practical utility in securing the DeFi ecosystem. In summary, this thesis advances the field of smart contract security by bridging the gap be-tween empirical study and automated tool development. By characterizing defensive practices and investigating the limitations of existing security tools, this work paves the way for more effective detection methods. The proposed hybrid framework demonstrates that integrating static analysis with the semantic reasoning of LLMs can effectively identify complex semantic smart contract vulnerabilities, providing the community with insights and tools to safeguard decentralized applications.
Context. Machine learning approaches for smart contract vulnerability detection are typically evaluated on synthetic benchmarks of programmatically generated code snippets. Practitioner reports and recent independent evaluations indicate that automated tools continue to miss critical vulnerabilities in production audits, yet the contribution of benchmark selection to this gap remains under-examined.Objectives. This study investigates whether surface-level Solidity features that correlate with vulnerability severity in synthetic benchmarks retain their predictive validity on professionally audited contracts, and proposes a quantitative metric for assessing benchmark suitability for severity prediction research.Methods. Fifteen features were extracted identically from a 10,448-sample synthetic Solidity benchmark and DAppSCAN, a corpus of 1,646 findings from 1,199 audit reports authored by 29 firms. Feature-severity correlations were compared using Fisher r-to-z, Kolmogorov-Smirnov, and Levene tests. Logistic Regression, Random Forest, and Gradient Boosted classifiers were trained in three conditions: in-distribution synthetic, in-distribution real, and cross-distribution.Results. Mean absolute correlation was 0.228 on synthetic data versus 0.057 on real data, a fourfold gap (all p
In this paper, we developed anomaly detection based on machine learning-based with the automated signing of the blockchain transaction system to effectively detect the anomalies to prevent the leakage of information from the bitcoin system. Initially, the anomalies data is collected from online resources. The automated signing of the transaction system is performed using machine learning. A blockchain transaction is used for the personalised identification of anomalies transactions. It secures the transactions from fraudulent blockchain transactions. Then, the anomaly detection is done by an optimised recurrent neural network with attention mechanism (ORNN-AM). Here, the parameters are optimised using fitness of firefly and driving training-based optimisation (FFDTO). Anomaly detection with the automated signing of blockchain transactions using machine learning techniques helps to detect anomalies effectively. The performance of anomaly detection with the automated signing of the blockchain transactions system is compared to other conventional anomaly detection models.
The security issues surrounding smart contracts have garnered significant attention due to potential vulnerabilities that can lead to financial losses and a decline in trust. Despite the development of various vulnerability detection methods by researchers, existing models often suffer from low accuracy and high false positive rates. Additionally, opcode-based vulnerability detection methods frequently introduce excessive noise due to long sequences, impairing the modelâs generalization capabilities. To address these challenges, this paper proposes a dual-branch vulnerability detection model, referred to as EXCT, which integrates features from both the original opcode sequences and significant opcode sequences. We employ an improved extractive summarization technique, KTextRank, to extract important opcode sequence segments. A hierarchical Transformer is utilized for global feature extraction, while Convolutional Neural Networks (CNN) are employed for local feature extraction from the original opcode sequences. Finally, we fuse the global and local features to effectively identify specific vulnerabilities within smart contract code. Experiments conducted on two real-world datasets demonstrate that our proposed approach significantly enhances performance on publicly available datasets.
With the increased usage of Bitcoin and othercryptocurrencies, there is a need to address issues related tofraud detection in cryptocurrency systems. Such issuesinclude double-spending, money laundering, and accounthacking, among others, that Bitcoin needs to guard against.However, since Bitcoin is decentralised and transactions arenot reversible, the use of central-system approaches cannotbe applied; thus, an alternative approach must be adopted.The presented project offers a viable method of usingmachine learning for Bitcoin fraud detection. The frauddetection method is real-time, using ensemble stacking,which entails combining multiple machine learning modelsto enhance prediction capabilities. Algorithms to be usedinclude Random Forest, Gradient Boosting (XGBoost,LightGBM), Support Vector Machine (SVM), LogisticRegression, and Isolation Forest. In other words, multiplealgorithms will be used to examine Bitcoin transaction data,such as amounts transacted, transaction frequency, andtransaction patterns. Ensemble stacking allows the use of thestrengths of multiple algorithms, while the real-time functionenhances the applicability of the approach. Scalability isanother critical consideration, especially considering thenumber of Bitcoin users. This is why the use of a Flaskapplication server will be necessary for user datasubmissions, visualisation, and sending fraud notifications.Evaluation will be based on accuracy, precision, recall, andF1-score.Conclusion â The proposed solution appears quiteplausible as the fraud detection through machine learning isefficient, while scalability is one of the main features of theapproach.
Decentralized finance (DeFi) platforms have experienced a rapid increase in fraudulent activities such as price manipulation, wash trading, and anomalous transaction behavior, while traditional centralized fraud detection methods remain unsuitable due to privacy and regulatory constraints. This study proposes a privacy-preserving fraud detection framework using federated learning, enabling multiple decentralized entities to collaboratively train a machine learning model without sharing raw transaction data. A real-world decentralized exchange (DEX) dataset containing over 100,000 transactions is preprocessed and enhanced through feature engineering techniques capturing swap rate deviations, transaction volume anomalies, and temporal patterns. In the absence of labeled fraud data, a heuristic-based labeling approach is employed to simulate realistic fraud scenarios. A Logistic Regression model is trained across multiple distributed client nodes, with model parameters aggregated using the Federated Averaging (FedAvg) algorithm over several communication rounds. The experimental findings show that the federated model delivers results similar to centralized methods while preserving data privacy, proving it to be an efficient solution for secure and scalable fraud detection in decentralized financial environments.
The rise of Bitcoin has revolutionized the financial landscape, but it has also opened the door to a new era of criminal activities. Criminals take advantage of the anonymity provided by Bitcoin to conduct illicit transactions and engage in fraudulent activities. To address this issue, this paper proposes a detection model using Graph Neural Networks (GNNs) to detect fraudulent activities in the complex financial systems of Bitcoin. From the GNNs, we use EvolveGCN and EvolveGGCN to compare between them and find a powerful model that can investigate the network construction of financial transactions and capture patterns and anomalies that traditional methods may miss. In the literature, there have been a limited number of studies on Bitcoin fraud detection using GNNs, especially EvolveGGCN. Therefore, in this paper, we focus on the detection of fraud in the Bitcoin network using EvolveGCN and EvolveGGCN. In addition, we used a more recent dataset called Elliptic++, which is an extension of the Elliptic Dataset. The dataset provides valuable information on the behavior and patterns of fraudulent actions in the Bitcoin network. The results show that EvolveGGCN outperforms other models in terms of precision, recall, F1 score, and micro-F1 score. With an F1-score of 0.90 and micro-F1 of 0.93 for detecting illicit transactions in the early time steps.
The rapid growth of Ethereum has enabled innovation in digital finance, smart contracts, and non-fungible tokens (NFTs) but it has also facilitated increasingly sophisticated phishing schemes. The existing fraud detection systems have limitations in addressing large-scale phishing involving multi-hop transaction patterns, rich edge metadata, extreme class imbalance, and hierarchical account organizations. This paper proposes a hierarchical multi-scale graph convolutional network (HMG-CN) that can: (1) adaptively fuse 1-3 hop convolutions to avoid over-smoothing, (2) perform edge-aware message passing conditioned on transaction attributes, (3) discover organizational structure via two-level hierarchical pooling, and (4) combine class-balanced focal loss with contrastive learning. In an experiment with a transaction graph with 805,327 nodes and 17.1 million directed edges derived from 47,123 labeled phishing addresses, HMG-CN outperformed classic machine learning (ML), graph embeddings, standard graph neural networks (GNNs), and recent phishing detectors across five different graph sizes. On 150,000 nodes, HMG-CN attained 0.943 F1 and 0.957 AUROC, exceeding the best baseline by 8.1% and 6.6%, respectively, uniquely improving its accuracy as the graph size increased. These results demonstrate that jointly modeling multi-scale structure, edges, and hierarchy yields scalable, accurate detection under low-prevalence conditions, providing a practical foundation for real-world blockchain security.
Alex J. Sinclair, Yuhan Zhang, Michael P. OâConnor, Li Wei
Graph Neural Networks (GNNs) have become the de facto standard for modeling blockchain transaction networks. However, standard GNN architectures predominantly operate under the assumption of homophily-that connected nodes share similar labels or features. This assumption catastrophically fails in the context of Ethereum phishing detection, a quintessential heterophilic learning problem where fraudsters (phishing accounts) actively connect with unlike victims (normal accounts) to facilitate theft. In this work, we argue that the "homophily bottleneck" in existing detection systems obscures critical high-frequency signals necessary for identifying illicit activity. We introduce the Heterophilic Semantic Graph Framework (HSGF), a novel architecture designed to decouple structural roles from feature smoothing. HSGF integrates a Motif-based Semantic Sampling (MSS) strategy to capture complex, directed transactional intents (e.g., dispersing, gathering, mixing) and a Heterophily-Aware Feature Fusion (HAFF) module that prevents the oversmoothing of fraudster representations into victim representations. Extensive experiments on real-world Ethereum datasets demonstrate that HSGF significantly outperforms state-of-the-art baselines, particularly in class-imbalanced scenarios, effectively breaking the ceiling imposed by traditional homophilic aggregation.