PaperlayerView exact revision on arXiv

Source-linked AI summary

Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding

Jiajing Wu, Qi Yuan, Dan Lin, Wei You, Weili Chen, Chuan Chen, Zibin Zheng

arXiv:1911.09259v2cs.SI

TL;DR

Phishing scams pose a serious security threat in blockchain ecosystems, and traditional phishing detectors do not directly fit Ethereum’s diverse scam behaviors. This paper mines public Ethereum transactions, embeds addresses with transaction-aware trans2vec, and classifies them using one-class SVM; experiments report effective detection and better feature extraction than state-of-the-art baselines.

  • Problem

    Ethereum phishing scams threaten trading security, while traditional phishing detectors cannot be directly applied to the platform’s more diverse scam behaviors.

  • Method

    The paper reconstructs a directed Ethereum transaction network, embeds addresses with trans2vec using transaction amount and timestamp, and applies one-class SVM classification.

  • Results

    Experiments on real-world Ethereum transactions demonstrate effective phishing detection and trans2vec’s superiority over baseline methods for feature extraction.

  • Takeaways & Limitations

    Transaction structure, time, and amount are indispensable features for phishing detection on Ethereum-like transaction networks.

Abstract

from arXiv · show

Recently, blockchain technology has become a topic in the spotlight but also a hotbed of various cybercrimes. Among them, phishing scams on blockchain have been found making a notable amount of money, thus emerging as a serious threat to the trading security of the blockchain ecosystem. In order to create a favorable environment for investment, an effective method for detecting phishing scams is urgently needed in the blockchain ecosystem. To this end, this paper proposes an approach to detect phishing scams on Ethereum by mining its transaction records. Specifically, we first crawl the labeled phishing addresses from two authorized websites and reconstruct the transaction network according to the collected transaction records. Then, by taking the transaction amount and timestamp into consideration, we propose a novel network embedding algorithm called trans2vec to extract the features of the addresses for subsequent phishing identification. Finally, we adopt the oneclass support vector machine (SVM) to classify the nodes into normal and phishing ones. Experimental results demonstrate that the phishing detection method works effectively on Ethereum, and indicate the efficacy of trans2vec over existing state-of-the-art algorithms on feature extraction for transaction networks. This work is the first investigation on phishing detection on Ethereum via network embedding and provides insights into how features of large-scale transaction networks can be embedded.

I. INTRODUCTION

Ethereum’s openness makes transaction records available for phishing detection, but diverse scam behaviors, extreme imbalance, and network heterogeneity complicate identification. The paper addresses these challenges with transaction-aware network embedding and one-class classification.

  • Motivation: Ethereum phishing scams threaten trading security, including a Bee Token scam that swindled nearly $1 million in 25 hours.The paper also reports 30,287 victims losing $225 million in the first half of 2017 across cryptocurrency scams.
  • Motivation: Traditional phishing detectors cannot be directly applied because Ethereum scams can spread through emails, websites, and other channels while targeting addresses and funds.Traditional methods commonly focus on phishing emails or websites, whereas Ethereum scams can use more diverse mechanisms.
  • Problem formulation: Ethereum’s public transaction records can be modeled as a directed network whose nodes are addresses and whose edges represent ether transfers.The paper uses transaction mining as an alternative source of evidence for phishing identification.
  • Challenges: More than 500 million addresses and 3.8 billion transactions contrast with only 2041 labeled phishing addresses, creating extreme data imbalance.The paper characterizes this setting as searching for a needle in a haystack.
  • Challenges: Network heterogeneity makes topology-only classification difficult because popular addresses attract many transactions while most normal and phishing addresses have few.This heterogeneity includes wallets, exchanges, and famous ICO addresses.
  • Approach: The proposed framework builds a labeled Ethereum transaction network, uses trans2vec with transaction-amount and timestamp biases, and applies one-class SVM classification.The design targets both feature extraction and the imbalance and heterogeneity challenges.

A. Frauds on Blockchain

Blockchain fraud research spans multiple scam types and Ethereum-specific studies, while traditional phishing work focuses mainly on impersonated websites, emails, and their content. The paper instead detects phishing addresses by mining Ethereum transaction behavior.

  • A. Frauds on Blockchain: Blockchain fraud research identifies categories including Ponzi schemes, mining scams, scam wallets, and fraudulent exchanges.The paper cites prior empirical work on bitcoin financial scams and Ethereum Ponzi schemes.
  • B. Phishing Scams: Traditional phishing is defined as impersonating an honest firm’s website to obtain private information such as usernames, passwords, and social security numbers.Typical attacks begin with an email that appears to come from an authentic organization.
  • B. Phishing Scams: Existing anti-phishing methods include multilabel classification, visual comparison of suspected and legitimate pages, and SVM-based website detection.These approaches primarily address conventional phishing websites or their content.
  • B. Phishing Scams: Ethereum phishing can obtain sensitive information or directly swindle money by spreading phishing addresses through emails, websites, and online chats.This broader behavior means website-based detection covers only a small part of Ethereum phishing scams.
  • B. Phishing Scams: Because Ethereum transaction records are public, suspicious addresses can be identified by mining transaction behavior between addresses.The paper models these records as a directed transaction network and applies network embedding for detection.
  • B. Phishing Scams: Ethereum phishing detection differs from conventional detection in its target objects, data sources, and methods, focusing on phisher addresses rather than websites.Figure 1 compares the two detection frameworks across these dimensions.

C. Anomaly Detection Based on Network Embedding

Network embedding is presented as an emerging basis for anomaly detection, and this study applies it to phishing-address identification on Ethereum’s large, heterogeneous transaction network. Because labels are extremely imbalanced, the framework uses one-class anomaly detection rather than supervised binary classification.

  • Network-based anomaly detection applies to static or dynamic graphs with tags or attributes across areas including finance and security.
  • Network-embedding methods learn node representations that can serve as features for downstream machine-learning tasks.Existing approaches include factorization, random walks, deep learning, and miscellaneous strategies.
  • The study detects phishing addresses from large-scale Ethereum transaction records by constructing a transaction network from collected records.Each node represents an address, while edges represent ether transactions between address pairs.
  • Only 1259 of more than 500 million Ethereum addresses were labeled phishing, creating extreme data imbalance alongside heterogeneous node types.The network includes phishing addresses, exchanges, smart contracts, and common unknown addresses.
  • One-class SVM converts phishing detection into outlier detection by finding a decision surface around target nodes in feature space.Nodes inside the surface are classified as phishing targets, while nodes outside are treated as other nodes.

B. Problem Definition

The paper models Ethereum as a partially labeled transaction network whose edges carry transaction amount and timestamp attributes. It proposes biased network embeddings for downstream phishing classification and illustrates the overall construction-and-embedding workflow.

  • Ethereum is represented as a graph G = (V, E), with a partially labeled network GL = (V, E, X, Y).X stores edge attributes, while Y stores node labels.
  • Transaction amount and timestamp are the two critical attributes attached to Ethereum transaction-network edges.
  • The proposed biased network embedding learns d-dimensional embeddings XE ∈R|V|×d for all nodes as inputs to downstream classification.The embedding is designed for phishing detection on an extremely large-scale Ethereum network with imbalanced labels.
  • Figure 3 illustrates the embedding procedure for the Ethereum transaction network.The model framework covers transaction-network construction, embedding, and phishing detection.

A. Feature Learning Process

Random-walk network embedding combines neighborhood sampling with Skip-gram optimization to learn node features. For Ethereum, trans2vec uses transaction amount and timestamp to bias sampling and capture transaction-network information more comprehensively.

  • Random-walk embedding transforms a large network into node sequences and learns mappings from nodes to d-dimensional embeddings.The process uses a random-walk generator for structural relationships and Skip-gram for embedding learning.
  • Skip-gram maximizes co-occurrence probabilities among nodes sampled within a neighborhood sequence.The paper optimizes log Pr(NS(u) | f(u)) using stochastic gradient descent.
  • Unlike words in a linear document, network nodes require a separate method to define each node’s neighborhood.
  • For Ethereum, trans2vec proposes three biased random-walk strategies that consider each transaction’s amount and timestamp.These strategies are intended to extract transaction-network information more comprehensively.
  • A walk beginning at source node u generates a fixed-length sequence of l nodes, with each next node selected probabilistically.The sequence uses c0 = u as its starting node.

1) Random Walks:

The method biases random walks over Ethereum’s transaction network using transaction amounts and timestamps, with α balancing their influence during neighborhood sampling.

  • Random Walks: Ethereum transaction networks represent addresses as nodes and transfers between addresses as directed edges.The network is built from transaction records, with addresses and accounts used interchangeably.
  • Random Walks: Amount-based sampling assigns greater transition preference to neighbors connected by larger transaction values.A(u, x) denotes the total transaction amount between nodes u and x.
  • Random Walks: Time-based sampling favors more recent transactions by using the latest transaction timestamp between neighboring addresses.Real timestamps are mapped to discrete time steps ordered ascendingly.
  • Random Walks: The resulting search strategy can select different neighbors depending on whether amount-based or time-based sampling dominates.In the illustration, x4 is favored by amount-based sampling, whereas x1 is favored by time-based sampling.
  • Random Walks: The parameter α balances amount and time biases in the unnormalized transition probability.When α is small, sampling favors time; otherwise, it favors amount.

3) trans2vec Algorithm:

trans2vec embeds transaction information into node vectors by repeatedly generating biased random walks and learning representations from the resulting walk contexts.

  • trans2vec Algorithm: trans2vec is a random-walk network embedding method designed to encode transaction information in node representation vectors.Its walk strategy uses transaction-network transition probabilities incorporating the search bias parameter α.
  • trans2vec Algorithm: The algorithm preprocesses transition probabilities, generates r walks of length l from each source node, and collects the walks.The input graph includes edge transaction amounts and timestamps, embedding dimension d, context size k, and α.
  • trans2vec Algorithm: During each walk, trans2vec obtains the current node’s neighbors, samples the next node using alias sampling, and appends it to the walk.This process repeats for the specified walk length before returning the completed walk.

C. Phishing Detection Framework

The phishing-detection framework builds an Ethereum transaction subnetwork, embeds addresses with trans2vec, and classifies them using one-class SVM, with experiments comparing alternative representations and sampling strategies.

  • Phishing Detection Framework: The framework builds an Ethereum transaction network from collected transaction records and labeled phishing addresses.Nodes are classified as phishing or other addresses, while edges represent transactions between address pairs.
  • Phishing Detection Framework: trans2vec extracts address features using biases based on transaction amount and timestamp.The resulting node embeddings are used as feature inputs for phishing-scam detection.
  • Phishing Detection Framework: A one-class SVM classifies phishing and nonphishing nodes from the extracted features.The experiment uses 1,259 labeled phishing addresses and randomly selects 1,259 unlabeled nodes as outliers.
  • Phishing Detection Framework: Fifty subnetworks are created by repeatedly sampling unlabeled nodes and extracting their first-order neighborhoods.These subnetworks contain more than 60,000 nodes and 200,000 links on average.
  • Phishing Detection Framework: The experiments compare trans2vec with DeepWalk and node2vec and separately evaluate time-only, amount-only, and combined biased sampling.The embedding settings include d = 64, r = 20, l = 5, and k = 10, with α = 0.5 as the default trans2vec value.

C. Performance Evaluation Metrics

The evaluation uses precision, recall, and F-score, averaging results over repeated experiments. Comparisons show that combining transaction features with network structure and using trans2vec improves phishing classification.

  • Metrics: Precision, recall, and F-score are the three metrics used to evaluate phishing-detection performance.Each experiment is repeated 100 times on every subnetwork, and average results are reported.
  • Nonembedding comparisons: Nonembedding methods achieve unsatisfactory phishing-detection performance when they use only time, amount, or combined transaction features.Combining time and amount performs better than either feature type alone, but remains insufficient without structural information.
  • Embedding comparisons: At embedding dimension d = 64, trans2vec outperforms the other embedding methods on precision, recall, and F-score.Amount-based and time-based biased samplings outperform unbiased DeepWalk, with amount bias producing the stronger result.
  • Feature requirements: Structural information, transaction time, and transaction amount are all indispensable features for phishing detection.The conclusion combines the nonembedding and embedding comparisons.
  • Embedding dimension: Increasing the embedding dimension from 4 to 64 improves classification performance, while very small dimensions make trans2vec relatively weaker on recall and F-score.Larger vectors are described as retaining richer network structure and node information.
  • Classifier comparison: With trans2vec representations of dimension d = 64, one-class SVM performs better than logistic regression, naive Bayes, and isolation forest.The paper selects one-class SVM because it is considered more suitable for anomaly detection.

E. Parameter Sensitivity

Parameter analysis evaluates trans2vec using F-measure while varying one parameter at a time. Performance generally improves with balanced sampling and larger neighborhood settings, but some parameters eventually saturate or reduce representation quality.

  • Analysis setup: The parameter analysis varies one trans2vec parameter at a time while keeping all other parameters at their default values and compares F-measure.The analysis covers panels Fig. 7(a)–(e).
  • Sampling bias: F-measure peaks when α is around 0.5, indicating that combining time-based and amount-based sampling biases performs best.α = 0 corresponds to time-based sampling, whereas α = 1 corresponds to pure amount-based sampling.
  • Walk parameters: Increasing walk length l from 2 to 6 improves performance, but longer walks reduce representation quality because the algorithm repeatedly visits the same node.The resulting decrease affects overall performance.
  • Walk parameters: Using more walks per node improves performance by increasing the number of sampling times.This effect is reported in the analysis of Fig. 7(e).

F. Scalability

The scalability evaluation measures trans2vec runtime on increasingly large random graphs. Runtime scales linearly with the number of nodes, supporting its use on large-scale networks, while the study also identifies broader research boundaries.

  • Scalability evaluation: Scalability is evaluated on Erdős–Rényi graphs whose sizes increase from 10^2 to 10^5 nodes using default parameters and 100 trials per size.Average running time is computed for each network size.
  • Scalability result: Trans2vec scales linearly with the number of nodes in the running-time evaluation.Running times are shown on a logarithmic scale, and the authors consider the scaling acceptable in practice.
  • Scalability result: The authors conclude that trans2vec is suitable for applications on large-scale networks.This conclusion follows directly from the reported linear scaling.
  • Scope boundary: The study focuses on phishing detection, so the effects of the proposed embedding on other realistic downstream tasks remain to be verified.The authors identify this as a future research issue.
Loading 1911.09259v2…