The phenomenon of cryptocurrencies continues to draw a lot of attention from investors, innovators and the general public. There are over 1300 diferent cryptocurrencies, including Bitcoin, Ethereum and Litecoin. While the scope of blockchain technology and cryptocurrencies continues to increase, identification of unethical and fraudulent behaviour still remains an open issue. The absence of regulation of the cryptocurrencies ecosystem and the lack of transparency of the transactions may lead to an increased number of fraudulent cases. In this research, we have analyzed the possibility to identify fraudulent behaviour using diferent classification techniques. Based on Etherium transactional data, we constructed a transaction network which was analyzed using a graph traversal algorithm. Data clustering was performed using three machine learning algorithms: k-means clustering, Support Vector Machine and random forest classifier. The performance of the classifiers was evaluated using a few accuracy metrics that can be calculated from confusion matrix. Research results revealed that the best performance was achieved using a random forest classification model
tocurrency by market capitalization, is the top choice
for fraudulent activity. The aim of this paper is to
anaCryptocurrencies are a viable alternative to traditional lyze the possibility to use machine learning techniques
mediums of exchange for purchasing goods or services. to identify wallets engaging in fraudulent activities in
The main idea behind such type of currency is that the Ethereum blockchain.
exchange between two parties can occur without the The rest of the paper is organized as follows. Related
involvement of a central authority. It is the network it- work in this area is presented in section 2. Section 3
inself that manages and confirms each transaction. The troduces the dataset used in the current study and the
overall history of transactions is controlled using the performed preprocessing steps. Section 4 presents the
blockchain technology, which can be described as a selected clustering techniques. Section 4.4 describes
growing list of records, that are linked together using accuracy metrics that was used to evaluate
compucryptography. Each block contains a cryptographic tational results. Experimental results are provided in
hash of the previous block, a timestamp and transac- section 5. Finally, concluding remarks and future plans
tion data. Even though blockchain technology records are discussed in Section 6.
information about each transaction, it also assures
person anonymity, as long as there is no link between
the wallet and its owner identity. Due to this reason, 2. Related Work
cryptocurrencies are more frequently used for
fraudulent activities[
Upon comparing the results of the three iterations curacy of 99.66%. Moreover, 5-fold cross-validation
the over-sampled datasets of the models were discarded. was used to prevent the models from over-fitting.
Moreover, the performance across seven algorithms: A comprehensive identification model for detection
Decision Trees, Bagging, Random Forests, Extra Trees, of phishing scams in Ethereum is discussed in [
In this research Bitcoin transaction network were posed detection framework is efective and trans2vec is transformed into two graphs: with nodes as users and more superior than baseline methods in terms of feawith nodes as transactions. The dataset consists of ture extraction. more than 6 million unlabeled users with more than To sum up, some of these articles claim to have a 37 million transactions and 30 revealed thieves in Bit- high accuracy of fraudulent behavior identification recoin network. However, due to the long run-time, the sults, while there are few low accuracy results in other dataset were limited to 100,000. Both Unsupervised articles. One of the article has detected that a new alSVM method and Mahalanobis distance based method gorithm gives better results than the basic methods. suggested similar suspicious users. In this case two The diferent types of data, its size and information cases of theft and one case of loss out of the 30 known have caused the diferences between the results, while cases were detected. applying the same models. In order to analyze the ac
The use of machine learning techniques for the iden- curacy while using our own data, we decided to use
tification of abnormal activities in the Ethereum net- 3 very popular and the most common methods:
Kwork is discussed in [
dresses; 3.1. Initial data 2. testing on randomly 50 malicious addresses out A data set consists of two collections of Ethereum transof possible 3830, under the assumption that the actions. The first collection is composed of about 420 addresses are marked as malicious, if they have fraudulent wallets identified from etherscamdb.info dataan outgoing transaction with the malicious mark- base. A detailed information about their transactions ed addresses was gathered from etherscan.io. The second data colMalicious addresses are considered to be the ones which lection represents non-fraudulent activities and conperform unauthorized or illegal actions, such as: issues sists of 53 wallets and their transactional information fake tokens, fake admin in ICOs (Initial coin Ofering), gathered from etherscan.io database. Each data set inscambot phishers, slackbot, fake etherscan site, fake cludes: • transaction hash code • sender’s address • receiver’s address • transaction value • time at which transaction was made • Ethereum block number.
Transactional data was transformed into a graph, where a manual selection of clusters. Algorithm‘s inability where x is a data point and
is a -th cluster‘s centroid. Each centroid is calculated by averaging given input vectors: =
1 | | ∑ .
∈ The objective of a k-means algorithm is to minimize total intra-cluster variance.
Among the many disadvantages of the k-means clustering algorithm, such as vulnerability to outliers or inability to cluster heavily overlapping data, there is to automatically select an optimal number of clusters in some cases makes it the unreliable solution to data partitioning as defining a number of clusters for unlabeled data leaves the user with uncertainty especially when working with large amounts of data. However, there is no need for guessing the number of clusters as there are a few methods that search for an optimal number of clusters. One of them is the elbow method.
It is one of the oldest methods for defining an optimal
number of clusters and works by calculating the sum
closest centroid [
performed by a sending wallet; • standard deviation of transaction time in seconds to receiving wallet - standard deviation of time between transactions to a receiving wallet; • average value in ETH sent by a wallet; • average value in ETH received by a wallet.
The first method that we considered was the k-means techniques. Also k-means clustering may help to determine underlying patterns of fraudulent and nonfraudulent behaviour by grouping similar wallets’ activities. K-means clustering algorithm works by allocating data points from given input vectors to a predeifned number of clusters using similarity criteria, usually Euclidean distance: || − || , 2 • average time between transactions performed by of squared distances between every data point and its siderably small comparing to other similar clustering clustering algorithm as its computational times are con- perplane in a -dimensional space (where is a number of factors used as input for the model) and sep ∑ =1 ∈ ∑ || − || .
2 The optimal number of clusters can be identified by visible "elbow" on the curve (see fig. 1). The last number before curve flattens is an optimal count of clusters. The main drawback of this method occurs when there is no visible "elbow" on the curve or more than one "elbow" is visible.
In order to find an optimal boundary between wallets
with fraudulent and non-fraudulent behaviour,
Support Vector Machine (SVM) is used. It ofers high
accuracy and requires less computational power than other
machine learning algorithms. SVM aims to find a
hyarates given data points into new classes. SVM can
be used both for regression and classification
problems [
∈ {−1, 1}
these pairs, we define a hyperplane that will separate
[
[ + 0].
For a nonlinear SVM classification, kernel method is being used. Kernel method generates algorithms that space. Popular kernel functions used in this method are: • Polynomial: ( , ) = ( ⋅ + 1) , where is a degree of polynomial; • Gaussian radial basis function (RBF): ( , ) = exp{− || − || } 2 where > 0
; • Sigmoid: (, ) = ℎ ( + )
Random Forest is a supervised machine learning algorithm that can be used to solve classification or regression problems and is more flexible with input data than SVM, especially working with large amounts of data.
It is a decision tree–based algorithm that randomly selects various data samples and by calculating predictions for every tree makes decisions from which it partitions input data into new subsets. It uses averaging maps given input data into a high-dimensional feature to improve the classification accuracy and controls the model to avoid over–fitting. For a -dimensional input = ( 1, 2, … , ) the goal of a random forest
( ) for
predicting a response variable Y. The predictive function
minimizes the expected value of the loss by using a loss
function ( , ( )) that usually is zero-one loss [
= ( ) otherwise
To estimate the accuracy of the proposed models, we
use a few commonly used metrics [
TPR also is known as sensitivity or recall, shows the amount of successfully predicted class‘ values compared to all class‘ values in a data set. • True Negative Rate (Selectivity): = =
Kernel F1-measure
Polynomial 92
Sigmoid 89
GRB 93
Linear 89
In this case, we decided to cluster the data into two
groups referring to fraudulent and non-fraudulent
wallets. We also performed an Elbow method to identify
the optimal number of clusters (fig. 1), which
conifrmed that two clusters are an optimal choice.
Using the actual data labels, we evaluated the accuracy
of the k-means algorithm. Results revealed that
overall clustering accuracy reaches 87% (see table 2).
However, while fraudulent wallets were clustered with 93%
accuracy, all non-fraudulent wallets were labeled as
frauds (table 2). A more detailed study of clustering
results was carried out using graphical analysis. For
example, figure 2 represents the relationship between the
average value in ETH sent by a wallet and the average
time between outgoing transactions. Diferent colours
TNR also known as selectivity, is the amount of Table 3
successfully predicted values for another class.
Accuracy for diferent types of kernel
• Precision (Positive Predicted Value):
1-measure is a harmonic mean of recall and
precision [
Here is true possitive (successfully predicted first class‘ values), is true negative (successfuly predicted second class‘ values), is false positive (faulty predicted second class‘ values also refered as type I error) and is false negative (faulty predicted first class‘ values also refered as type II error). represent separate clusters. By comparing clustering results with the labelled dataset (fig. 3), we can see that the algorithm identifies the most extreme cases (cases with the largest values). However, the model is unable to separate the rest of the data. Based on these results, we can conclude that k-means clustering provides unreliable results.
In order to achieve the best classification result, we have performed experiments using four support vector machine classification models: • linear SVM; • SVM with polynomial kernel; • SVM with sigmoid kernel; • the average value in ETH sent by a wallet; • average time between outgoing transactions; • standard deviation of time between outgoing transactions; • frequency of outgoing transactions.
After defining the list of parameters that have the highest influence on classification results, random forest classification algorithm was performed. To evaluate model‘s accuracy we used accuracy metrics discussed in subsection 4.4. RFS model reaches 95% accuracy (see table 5). This method predicts fraudulent wallets with 97% accuracy and non-fraudulent wallets with 67%.
• SVM with Gaussian Radial Basis (GRB) kernel. In this research, we investigated three machine learning techniques to identify fraudulent behaviour in the
Labeled data set was split into training (80 percent Ethereum blockchain data set. First of all, we sugof data) and testing (20 percent of data) sets. The high- gested the data preprocessing framework for the exest accuracy (93%) was achieved by using nonlinear traction of individual behaviour patterns from a transSVM model with Gaussian Radial Basis (GRB) kernel actional dataset. Based on these patterns, the proposed (table 4). However, although using nonlinear SVM with models were trained and compared according to seGRB kernel 96% of fraudulent wallets were classified lected accuracy measures. Experimental results revealed correctly, 54% of non-fraudulent wallets were classi- that the random forest classification method is the most ifed as frauds. suitable for the identification of fraudulent behaviour. Furthermore, the model suggests that the most impor5.3. Random Forest Classifier tant factors for fraudulent behaviour identification are total value in ETH sent by a wallet, the average value After performing classification with RFC with 90 trees, in ETH sent by a wallet, the average time between outwe extracted feature importances for model fine tun- going transactions, the standard deviation of time being (fig. 4). Parameters with importance level higher tween outgoing transactions and the frequency of outthan 0.1 were selected as the most important: going transactions.
• total sent value in ETH; In the future, we are planning to improve the
proposed model‘s reliability by increasing the number of
both fraudulent and non-fraudulent wallets. Moreover, 7. Acknowledgments
we are planning to analyse the possibility to use
XGBoost method, as it was suggested to use for
identiifcation of abnormal activity in blockchain data [
Furthermore, we are planning to perform a statistical significance test in order to find out whether diferences between results are statistically significant.
We thank Tadas Tamošiu¯nas, Pavel Sokolov and UAB
Kevin EU 1 for cooperation and useful insights.