Extracting Illicit-Rich Subgraph from Transaction Networks via Feed-Guided Shortest Paths

• Illicit activity is rare, and SPNSA’s output is feed-sensitive; transaction graphs also lack the organizational-role cues used to choose feeds in its Enron evaluation.Source: §1 · pp. 1–2
• The study focuses on graph-only feed selection for compact, illicit-enriched investigative subgraphs rather than proposing a new classifier.Source: §1 · p. 2
• Motif-based feed selection outperforms the other tested strategies, achieving an approximately 14× higher illicit ratio than random feed selection on Elliptic and substantial gains on IBM-AML HI variants.Source: §1 · p. 3

2.1 Shortest Paths Network Search Algorithm (SPNSA)

• For each feed node, SPNSA finds central intermediaries in its directed r-hop ego-network and unions shortest paths connecting the feed to those intermediaries and nearby feed nodes.Source: §2.1 · p. 3

2.2 Feed construction strategies

• The compared strategies use graph topology and degree statistics, with S0 serving only as a label-informed upper bound; alternatives include random, degree-imbalance, mixed sender/receiver, and motif-based feeds.Source: §2.2 · pp. 3–4
• S4 targets graph-visible laundering patterns, including short cycles, fan-in/fan-out, and relay structures, using local directed-neighborhood motif counts.Source: §2.2 · p. 4
• S4 computes motif scores within a candidate pool and combines log-compressed signals with a degree penalty that discourages generic hubs.Source: §2.2 · pp. 4–6
• Its motif score includes thresholded fan-in/fan-out and counts of low-degree neighbors, helping distinguish star-like patterns from generic hubs.Source: §2.2 · pp. 4–5
• Rather than selecting the globally highest-scoring nodes, S4 chooses candidates near multiple high-scoring centers in the undirected graph, enforcing locality until the feed reaches size k.Source: §2.2 · p. 5

3.1 Datasets

• Experiments use IBM-AML HI-Small, LI-Small, and HI-Medium synthetic graphs, alongside the real-world Elliptic Bitcoin transaction graph.Elliptic has illicit/licit labels for a subset of nodes.Source: §3.1 · p. 6

3.2 Preprocessing

• IBM-AML transaction-level illicit labels are converted to node labels; experiments use its largest weakly connected component and simple directed graphs.A node is labeled illicit if it is an endpoint of at least one laundering transaction; 99.6% of illicit-labeled nodes lie in the largest weakly connected component.Source: §3.2 · p. 7

3.3 Evaluation protocol

• Evaluation reports extracted-subgraph vertex and edge counts and illicit ratio; labels are used only for evaluation, with a labeled-only enrichment metric also reported for Elliptic.The main Elliptic metric treats unlabeled nodes conservatively as licit.Source: §3.3 · p. 7

3.4 Experimental settings

• The study tests feed sizes k=200 and 500 and radii r=1 and 2; random-feed results average 100 trials, and S4 parameters were coarsely tuned for compactness and enrichment.Most S4 parameters were fixed across datasets; τ, s_in, and the number of centers m varied by dataset family.Source: §3.4 · p. 7, Table 2 · p. 8

3.5 Results

• At k=200, r=1 on LI-Small, S2 reaches 11.4% illicit ratio versus S4’s 5.5%; S2 is the strongest heuristic in this lowest-base-rate variant.LI-Small’s dataset-level illicit ratio is 1.04%.Source: §3.5 · p. 8
• For Elliptic S4, increasing k from 200 to 500 grows output from 213 to 554 nodes and drops illicit ratio from 33.8% to 13.0%; larger feeds generally expand outputs and often lower ratio.Increasing radius also enlarges ego-networks and tends to increase output size, while its effect on illicit ratio varies by dataset.Source: §3.5 · p. 8
• S4 has the highest illicit ratio on Elliptic and both IBM-AML HI variants; at k=200, r=1 it yields 33.8% on 213-node Elliptic and ≈16%–29% on HI variants.The results cover the tested SPNSA configurations; the HI range depends on (k, r).Source: §3.5 · p. 8, Figure 2 · p. 9
• Across datasets, k-hop expansion yields larger subgraphs but lower illicit ratios than both induced-feed subgraphs and SPNSA.The authors report that naive neighborhood expansion dilutes enrichment more strongly.Source: §3.5 · pp. 8, 10

4 Discussion

• S4 prioritizes nodes with laundering-like local directed neighborhoods and enforces locality through multi-center selection, shifting SPNSA toward compact, enriched subnetworks.SPNSA aggregates shortest paths in feed-centered ego-networks; the discussion contrasts this approach with feeds that cover unrelated graph areas.Source: §4 · p. 10
• On LI-Small, S2 provides the strongest enrichment; mostly-sender or mostly-receiver nodes may be more informative there than S4's current motif score.The paper presents this as a plausible interpretation and recommends treating feed selection as dataset-dependent.Source: §4 · p. 10
• Larger feeds and radii increase output size and can reduce illicit concentration; k = 200 and r = 1 are attractive starting points for investigative use.Broader coverage can be pursued by increasing k or r, with an expected reduction in illicit ratio.Source: §4 · p. 10
• Elliptic's main illicit-ratio metric treats unlabeled nodes as licit, while graph construction discards transaction frequency and temporal information.The study also reports a labeled-only metric variant; the discarded information may be relevant to laundering behavior.Source: §4 · p. 10

5 Conclusion and Future Work

• S4 consistently produces higher-illicit-ratio subnetworks than random feeds and common degree-based heuristics on Elliptic and IBM-AML HI-Small/Medium, while keeping them small enough for human inspection.On IBM-AML LI-Small, a simple degree-difference rule can outperform S4, showing that the best graph-only strategy depends on dataset regime.Source: §5 · p. 10
• Future work will incorporate temporal and multi-transaction information, develop adaptive motif-feed parameter selection, and validate findings on additional real transaction graphs.Source: §5 · p. 11

A Appendix

• Table 3 covers IBM-AML LI-Small, HI-Small, HI-Medium, and Elliptic.Source: Table 3 · p. 11
• The table defines illicit ratio as the number of illicit nodes in the extracted SPN divided by its number of vertices.Source: Table 3 · p. 11
• Results are shown by feed size k and ego-network radius r, with S1 values averaged over 100 random trials.Source: Table 3 · p. 11

(b) IBM-AML (HI-Small)

• For Elliptic, IR counts unlabeled nodes as licit, whereas LIR excludes unlabeled nodes from the denominator.Source: (b) IBM-AML (HI-Small) · p. 11
• Table 4 compares S4-based k-hop expansion, induced-subgraph extraction, and SPNSA across datasets at feed size 200 and radius 1.Source: Table 4 · p. 12