Source-linked AI summary
TTAGN: Temporal Transaction Aggregation Graph Network for Ethereum Phishing Scams Detection
Sijia Li, Gaopeng Gou, Chang Liu, Chengshang Hou, Zhenzhen Li, Gang Xiong
TL;DR
Phishing scams threaten Ethereum, while existing detection methods underuse transaction temporal information and rely on manually designed node features. TTAGN models temporal transaction relationships, aggregates edge representations into trading features, and combines them with statistical and structural features; it achieves 92.8% AUC and 81.6% F1-score on Ethereum phishing datasets.
Problem
Existing Ethereum phishing-detection methods rarely use transaction temporal information and rely on manually designed node features, limiting their ability to represent transaction edges and nodes.
Method
TTAGN uses LSTM-based temporal edge representations, aggregates neighboring edge representations into trading features, and combines them with structural and statistical features.
Results
92.8% AUC and 81.6% F1-score: TTAGN outperforms compared methods on the D3 Ethereum phishing-scam dataset.
Takeaways & Limitations
Temporal edge modeling and edge2node aggregation are both important for phishing detection, with removing edge2node lowering performance by 6.4% on D3.
Abstract
from arXiv · showhide
In recent years, phishing scams have become the most serious type of crime involved in Ethereum, the second-largest blockchain platform. The existing phishing scams detection technology on Ethereum mostly uses traditional machine learning or network representation learning to mine the key information from the transaction network to identify phishing addresses. However, these methods adopt the last transaction record or even completely ignore these records, and only manual-designed features are taken for the node representation. In this paper, we propose a Temporal Transaction Aggregation Graph Network (TTAGN) to enhance phishing scams detection performance on Ethereum. Specifically, in the temporal edges representation module, we model the temporal relationship of historical transaction records between nodes to construct the edge representation of the Ethereum transaction network. Moreover, the edge representations around the node are aggregated to fuse topological interactive relationships into its representation, also named as trading features, in the edge2node module. We further combine trading features with common statistical and structural features obtained by graph neural networks to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TTAGN (92.8% AUC, and 81.6% F1score) outperforms the state-of-the-art methods, and the effectiveness of temporal edges representation and edge2node module is also demonstrated.
1 INTRODUCTION
Ethereum phishing scams cause substantial economic losses, while existing detection methods are poorly adapted to address-based scams and underuse transaction history. TTAGN addresses these gaps by modeling temporal transactions, aggregating edge information into node trading features, and combining them with structural and statistical features.
- Ethereum phishing victims lost $645,000 in the first week and attackers exceeded $3,000,000 in illegal profits within one month.
- Traditional phishing detection focuses on forged websites or software, whereas Ethereum scams can directly induce remittances through phishing addresses.
- Existing Ethereum methods use transaction-network representations but often rely on manual-designed features and limited transaction information.
- TTAGN models temporal transaction records, aggregates edge representations into node trading features, and combines them with structural and statistical features.
- Experiments on real-world Ethereum phishing datasets report that TTAGN outperforms state-of-the-art methods on multiple metrics.
2 RELATED WORK
Prior Ethereum phishing-detection methods combine manual feature engineering with network embedding or graph learning. The paper identifies limited use of transaction temporal information and reliance on manual-designed node features as important weaknesses.
- Existing Ethereum phishing-detection methods fall into traditional machine-learning and network-representation-learning categories.
- Traditional methods extract statistical features from nodes and their neighbors before applying classifiers such as LightGBM.
- Network-embedding methods include DeepWalk, Node2Vec, Trans2Vec, E-GCN, and graph convolutional networks for learning graph features.
- Prior methods rarely use transaction-behavior temporal information, limiting their edge representations and leaving node representations dependent on manual-designed features.
- Network representation learning is commonly organized into factorization, random-walk, and deep-learning approaches.
3 PROBLEM DEFINITION
The task is formulated as graph node classification on a partially labeled Ethereum transaction network. Addresses are nodes, transactions are directed edges with transaction attributes, and the model learns embeddings for all nodes.
- Ethereum phishing detection is formulated as a graph node classification problem over a partially labeled transaction network.
- Each transaction address is represented as a node, while each transaction is represented as an edge in the graph.
- Transaction direction, amount, and time are edge attributes, while node labels identify the classification targets.
- The model learns d-dimensional representations for all nodes from the known large-scale transaction-network information.
4 DESIGN OF TTAGN
TTAGN represents Ethereum transaction nodes by modeling temporal transaction histories, aggregating neighboring edge representations into trading features, and enhancing them with structural information.
- TTAGN builds a directed Ethereum transaction graph whose nodes are addresses and whose edges represent transactions carrying amount and timestamp information.
- Temporal edges representation: The temporal edge module treats transactions between each node pair as timestamp-ordered sequences and uses an LSTM to learn edge embeddings.
- The overall architecture combines outputs from temporal edge representation, edge2node, and structural enhancement before classification.
- Temporal edges representation: The temporal module supports variable-length transaction histories and converts the multigraph into an undirected graph with learned edge representations.
- Edge2node: The edge2node module uses multi-level attention to weight adjacent edge representations and aggregate them into trading features.
- Structural enhancement: Structural enhancement combines trading and statistical features as node embeddings, applies a GCN, and reconstructs transaction-graph relationships through a graph autoencoder.
5 EXPERIMENTS
The experiments evaluate TTAGN’s detection effectiveness, component contributions, and sensitivity to temporal sequence length and attention hidden size.
- The experiments ask how effectively TTAGN detects phishing addresses on the Ethereum transaction network.
- Ablation analysis examines the contributions of temporal edge representation, edge2node, and structural enhancement to detection performance.
- Sensitivity analysis varies the maximum temporal sequence length and attention hidden size to assess changes in TTAGN performance.
5.1 Datasets
The evaluation data combine verified phishing addresses with their transaction-network neighborhoods, then use cleaned random-walk subgraphs at three scales.
- Data collection: As of July 2021, the dataset contained 4,932 verified phishing addresses collected from Etherscan’s Ethereum label cloud.
- Data collection: The collected neighborhood graph contained 6,844,050 addresses and 208,847,461 transaction records before subgraph sampling.
- Data cleaning: Data cleaning removed transactions before 2016-08-02 and addresses with fewer than 5 or more than 1,000 transaction records.
5.2 Experimental Setup
The study compares TTAGN with feature-based, factorization-based, random-walk, and deep-learning network-detection methods using four classification metrics and fixed training settings.
- Baselines: The comparison includes feature-based, factorization-based, random-walk, and deep-learning-based Ethereum phishing detection methods.
- Metrics: Evaluation uses AUC, recall, precision, and F1-score to measure phishing scam detection performance.
- Hyperparameters: All models use embedding size 10, while TTAGN uses attention hidden size 2 and learning rate 0.01.
5.3 Effectiveness Results (RQ1)
TTAGN outperforms the compared phishing-detection methods across four metrics, with particularly strong results on the largest transaction graph and against deep-learning baselines.
- 92.8% AUC, 85.9% Recall, 77.7% precision and 81.6% F1-score are achieved by TTAGN on D3.
- TTAGN’s AUC advantage over GraphSAGE widens from 6.5% on D1 to 12.6% on D3 as the graph grows.
- TTAGN’s four evaluation metrics are nearly 20% higher than feature-based methods, whose performance is worst across the comparisons.
- On D3, TTAGN exceeds LINE by 12.6% AUC and 18.4% F1-score among random-walk methods.
- On D3, TTAGN’s four evaluation metrics are nearly 10% higher than deep-learning network-representation methods.
5.4 Ablation Study (RQ2)
Ablation results show that temporal edge representation and edge2node aggregation are the strongest contributors to TTAGN, while structural enhancement provides a smaller but positive contribution.
- Removing temporal edge representation lowers AUC by 7%, 8.5%, and 9.8% on D1, D2, and D3, respectively.
- Figure 5 compares AUC and Recall for TTAGN with variants formed by removing individual modules.
- Removing edge2node lowers performance by 6.4% on D3, indicating that aggregating edge representations into nodes is important.
- Removing structural enhancement lowers D3 AUC by 3.1%, making it the least contributive of the three modules.
- The complete TTAGN outperforms the other ablation models across all three datasets, with model gaps widening on larger graphs.
5.5 Sensitivity Analysis (RQ3)
TTAGN generally improves as the transaction sequence length increases, although shorter sequences can sometimes perform better, while attention-size changes have little effect.
- Increasing the fixed transaction sequence length generally improves all four metrics across the datasets.
- Shorter transaction sequences sometimes outperform longer ones, potentially because longer sequences introduce information redundancy.
- TTAGN maintains similar performance across attention-size settings and remains the best-performing method compared with the Table 2 baselines.
- On D3, Recall drops only 0.06 when attention size changes from h=10 to h=2.
6 CONCLUSION
TTAGN models temporal relationships in Ethereum transaction histories, aggregates edge representations into trading features, and combines them with structural and statistical features for phishing detection. Experiments report improved performance and practicality over state-of-the-art algorithms.
- TTAGN models temporal relationships among historical transaction records to extract richer edge representations.
- The network aggregates edge representations around each node to fuse topological interactions into trading features.
- TTAGN combines trading, structural, and statistical features to enrich node representations for Ethereum phishing-scam detection.
- Extensive experiments indicate that TTAGN outperforms state-of-the-art algorithms by significant margins in performance and practicality.
- The authors frame Ethereum phishing as a serious threat requiring effective countermeasures from the blockchain community.