TY - GEN
T1 - Improving Streaming Cryptocurrency Transaction Classification via Biased Sampling and Graph Feedback
AU - Eloul, Shaltiel
AU - Moran, Sean
AU - Mendel, Jacob
N1 - Publisher Copyright:
© 2021 Copyright held by the owner/author(s). Publication rights licensed to ACM.
PY - 2021/12/6
Y1 - 2021/12/6
N2 - We show that knowledge of wallet addresses from the current time state of a blockchain network, such as Bitcoin, increases the performance of illicit activity detection. Based on this finding we introduce two new methods for the sampling of classifier training data so that precedence is given to transaction information from the recent past and the current time state. This sampling enables streaming classification in which a decision on the class of a transaction needs to be made based on data seen to date. Our new approach provides insight into how the dynamics of the blockchain network plays a central role in the detection of illicit transactions, and is independent of the classifier choice. Our proposed sampling methods enable graph convolution network (GCN) and random forest (RF) classifiers to better adapt to changes in the network due to significant events, such as the closure of a large 'Darknet' marketplace. We introduce Graphlet spectral correlation analysis for exposing the effect of such network re-organisation due to major events. Finally, based on our analysis, we propose a new two-stage random forest classifier that feeds back intermediate predictions of neighbours to improve the classification decision. Our methodology enables practical streaming classification, even in the scenario of very limited information on the feature space of each transaction.
AB - We show that knowledge of wallet addresses from the current time state of a blockchain network, such as Bitcoin, increases the performance of illicit activity detection. Based on this finding we introduce two new methods for the sampling of classifier training data so that precedence is given to transaction information from the recent past and the current time state. This sampling enables streaming classification in which a decision on the class of a transaction needs to be made based on data seen to date. Our new approach provides insight into how the dynamics of the blockchain network plays a central role in the detection of illicit transactions, and is independent of the classifier choice. Our proposed sampling methods enable graph convolution network (GCN) and random forest (RF) classifiers to better adapt to changes in the network due to significant events, such as the closure of a large 'Darknet' marketplace. We introduce Graphlet spectral correlation analysis for exposing the effect of such network re-organisation due to major events. Finally, based on our analysis, we propose a new two-stage random forest classifier that feeds back intermediate predictions of neighbours to improve the classification decision. Our methodology enables practical streaming classification, even in the scenario of very limited information on the feature space of each transaction.
KW - Bitcoin
KW - Blockchain
KW - Fraud
KW - Graph classification
KW - Network dynamics
UR - http://www.scopus.com/inward/record.url?scp=85121653001&partnerID=8YFLogxK
U2 - 10.1145/3485832.3485913
DO - 10.1145/3485832.3485913
M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???
AN - SCOPUS:85121653001
T3 - ACM International Conference Proceeding Series
SP - 761
EP - 772
BT - Proceedings - 37th Annual Computer Security Applications Conference, ACSAC 2021
PB - Association for Computing Machinery
T2 - 37th Annual Computer Security Applications Conference, ACSAC 2021
Y2 - 6 December 2021 through 10 December 2021
ER -