Detecting Malicious Accounts in Permissionless Blockchains using Temporal Graph Properties

A Blockchains is an ever-growing large directed temporal network with more and more industries starting to adopt it for their businesses. In permissionless blockchains, interactions (also called as transactions) happen between different types of accounts. In Ethereum mainnet public blockchain, these accounts can be either Externally Owned Accounts (EOA) or Smart Contracts (SC). Here, transactions from an EOA (called as an external transaction) are recorded on the blockchain ledger whereas transactions from an SC (called as an internal transaction) are not recorded on the ledger.

With actual money involved in most of the permissionless blockchains, an account must be able to perform secure transactions. Recently, many security threats to various blockchain platforms have been identified [1]. For some identified vulnerabilities, counter-measures have been implemented. We do not delve into surveying all the security threats. In [2], the authors survey security flaws that exist in Ethereum blockchains. In many of the security vulnerabilities identified in Ethereum blockchain, hackers target other accounts by either hacking SCs or implementing malicious SCs for cybercrimes such as ransomware, scams, phishing, and hacking of exchanges or wallets [3].

With an ever-increasing growth and adoption of blockchain technology by the industry and the crypto-currency market, permissionless blockchains are at the epicenter of increased security vulnerabilities and attacks. Our motivation for this work is based on the fact that there is limited work on learning the behaviors of the accounts in permissionless blockchains which are malicious and potentially victimize other accounts in the future. In short, we aim to identify malicious accounts so that the potential victims and blockchains can deploy counter-measures. In this paper, henceforth, we use term blockchain to represent permissionless blockchain. The techniques proposed in related studies classify accounts as malicious using either machine learning (ML) algorithms or motif-based (basic building subgraphs of a network) methods. Nonetheless, the features used by the available techniques are: (a) limited and not learned from the previous attacks on blockchains, and (b) extracted from the aggregated snapshot of time-dependent transaction graphs that do not consider temporal evolution of the graphs.

The temporal aspects attached to the features are essential in understanding the actual behavior of an account before we can classify it as malicious. For example, inDegree and outDegree features are time-variant and should be considered a time series. Nonetheless, it has been proven that the aggregated node degree distribution for accounts follows a power-law in blockchains such as Ethereum [4]. Here, questions that we ask are: does such behavior exist in all accounts? Is there a burst of degree for certain accounts at certain instances and can the existence of such bursts be used to identify malicious activity? To answer these question, we first identify the existence of bursts. Then to study the effect of bursts, we introduce features such as temporal burst, degree burst, balance burst, and gasPrice burst.

The fat-tailed nature of power-law degree distribution also gives rise to neighbor-hood-based fitness preferential attachment in blockchains [5]. In [5] authors defined fitness as “the ability of the node to attract new connections” and showed that the accounts that have high fitness sometimes are short-lived and indulge mostly in malicious activities while when they are long-lived they represent large organizations. Here, the authors define the fitness factor considering one previous time instance interactions. As it does not consider a temporal window, one drawback of the method lies in its ability to correctly classify malicious transactions that appear at an interval of 2 time units or more. Inspired by this, we define a neighborhood-based feature called attractiveness that takes into account a temporal window of size $\theta_{a}$ where $(0<\theta_{a}<T_{DS})$ and $T_{DS}$ is the duration for which we collect the dataset ($DS$). Our attractiveness measure takes into account the stability of directed transactions that happened between two accounts in the past. Intuitively, a malicious account will have high attractiveness as it will tend to transact with new accounts while benign accounts will have high neighborhood stability or low attractiveness.

As the behavior of an account can change from malicious to benign or from benign to malicious over time, there is a need for continuous monitoring and analysis of the real-time transactions given the history of transactions performed by an account. We thus study the evolution of malicious behavior over different timescales by creating sub datasets and then answer would a certain account show malicious behavior in future? Towards this, we first apply different ML algorithms and identify the most suitable unsupervised ML algorithm in the entire dataset that is able to cluster accounts most accurately. Then we apply the identified algorithm to different sub datasets within a temporal scale to capture the behavior changes.

In summary, following are our main contributions:

• •

  Feature Engineering: We identify feature vector for identifying malicious accounts based on previous attacks on blockchains and perform time series analysis. As new features, we propose temporal burst, degree burst, balance burst, gasPrice burst, and attractiveness.

• •

  Comparative analysis: We perform a comparative study with techniques proposed in related studies and identify best possible supervised and unsupervised ML algorithm with related hyperparameters when we use Ethereum transaction data.

• •

  Results: Our results demonstrate that ExtraTreesClassifier performs best with respect to balanced accuracy under supervised settings for the entire dataset while when using clustering techniques, we are able to identify 554 more suspect accounts. Analysis of behavioral changes reveal 814 suspects across different temporal granularities.

The rest of the paper is organized as follows. In section 2, we present background and the state of the art techniques for identifying malicious accounts and compare them. In sections 3 and section 4, we present detailed description of our methodology and the feature vector, respectively. This is followed by in-depth evaluation along with the results in section 5. We finally conclude in section 6 providing details on prospective future work. Further, in Table 1 we provide list of acronyms used in the paper.

There are two types of blockchain technologies, permissionless and permissioned. The major difference between two technologies is that in permissioned blockchain prior access approval is needed for performing any action on the blockchain while in permissionless blockchain anyone can perform actions on the blockchain without any approval. Further, there is no way to censor anyone from permissionless blockchains. Such aspects lead to more frauds and malicious activities to prevail in permissionless blockchains. Ethereum and Bitcoin use permissionless technology.

Ethereum was developed by Vitalik Buterin in 2013 [6] and allows users to run programs in its trusted virtual environment known as Ethereum Virtual Machine (EVM). These programs are called Smart Contracts (SC) and are stored on the ledger along with transactions performed on a given fixed address. Ethereum uses “Ether” as its native crypto-currency for transfer and transaction fees. Smart Contracts can also send, store and receive ethers. Once deployed it is a hard coded program that could only be fed with input to get output. Smart Contracts are also used by some applications for their processing. Such applications are called distributed applications or dapps. Although Ethereum is known for its security and trust a small bug in SC code can cause huge loss [7] of crypto-currency. Unlike Bitcoin, Ethereum uses list of accounts. For a valid transaction, amount is transferred from sender to receiver. If receiver is a SC, its code is executed and the state of the SC is updated. Internally, a SC could send a message or perform internal transactions with other accounts. Ethereum currently uses a refined form of PoW (Proof of Work) consensus algorithm. PoW is computationally expensive and energy inefficient.

There are vast number of studies in fraud detection [8]. Nonetheless, targeting Ethereum, Chen et al. [2] base their survey on attacks and defences in Ethereum. We do not survey all the attacks and defense mechanisms in this work. However, we provide an in-depth understanding of different methods used to detect accounts involved in malicious activity. Several works have tried to identify or categorize malicious accounts and activities in different types of blockchains. As blockchains have graph structure, most of these techniques study graph properties (such as node degree) to identify features before applying supervised or unsupervised learning.

In [9], authors used a bitcoin transaction network to detect malicious activity. They were able to detect three malicious attacks using unsupervised ML algorithms with a limited amount of available transaction data. In their followup work, they used a more comprehensive bitcoin transaction dataset (starting from genesis block until April 7^th, 2013) [10]. They employed data in two types of graphs namely User Graph and Transaction Graph. In user-graph nodes represent accounts and edges represent transactions, whereas in transaction-graph nodes represent transactions and edges represent flow of bitcoins. They first studied the flow of bitcoins to prove the existence of anomalies and then performed clustering to identify different attacks. They were able to detect the existence of one attack using the Local Outlier Factor (LOF). Inspired by [10], in [11], Monamo et al. also used bitcoin transaction data and proposed an update to counter scaling issues that are inherent in LOF. They validated their approach using trimmed K-Means, argued its usefulness in detecting anomalies and detected 5 out of 30 fraudsters.

In another bitcoin-related malicious activity detection [12], authors studied the detection of addresses involved in the Ponzi scheme. They used supervised learning and validated their results after addressing the class imbalance that is inherent in any malicious activity related to datasets. They identified that the Gini coefficient of outgoing values and the ratio between incoming and total transactions are the most important features for detecting Ponzi scheme related accounts. In another Ponzi scheme related study, in [13], authors use Ethereum data to extract features from operation codes (opcodes) of the smart contract’s bytecode. Their motivation behind the study was based on the fact that the opcodes reflect logic implemented in a SC and therefore provide useful features for identifying Ponzi and non-Ponzi SC. They also figured out that opcode features are more efficient than account based features while detecting Ponzi scheme accounts. In [14], authors use partial Ethereum transaction data to classify malicious accounts. They also performed a sensitivity analysis to study the effect of different classifiers on the feature set. In [15], to counter class imbalance, authors assumed that accounts connected to malicious accounts via incoming transactions are also malicious. They then studied various supervised ML algorithms to identify malicious accounts over this over-sampled Ethereum dataset. In a followup study of [15], in [16], authors used only those benign accounts who have never transacted with malicious accounts. Due to this, their feature vector has only transaction based properties but not the graph based properties.

N-motifs are frequently occurring subgraphs that serve as a basic building block of a network. Authors in [17] defined N-motif as a path of length $2N$ between two entities where transactions are also considered as vertices. Using N-motifs that are present in the transaction graph, in [17], authors studied transactions happening between entities (people or organizations with multiple accounts). They were able to correctly identify malicious accounts involved in gambling. In another study [18], authors analysed transfer of funds within a subnet and used temporal feature such as how quickly funds are cashed.

We present all the above-mentioned techniques in detail in Table 2 and present the features that the techniques used along with studied ML algorithm, their hyperparameters, accounts considered in the dataset and performance score. Note that all these techniques use features that are based on some graph properties, transacting amount, and active state to train the ML model. However, several other studies, such as [4, 19], use inferences drawn from the analysis of the transaction graph to mark malicious accounts. In [4], authors try to identify accounts indulging in DDos attack and argue that accounts that create multiple rarely used contracts are malicious. A similar approach is followed in [20] where they used only verified SC codes and introduced features like SC size, lifetime and average time between transactions (i.e. Inter-event time). In [19], authors deploy honeypot and analyze RPC requests to identify malicious accounts. They then analyze transactions to mark accounts as suspicious that accept crypto-currency from malicious accounts. They perform behavior analysis to identify fisher accounts and attacks such as crypto-currency stealing.

All the above techniques either use a limited set of ML algorithms on a highly scaled-down data inducing over-fitting or apply inferences on the graph structure to identify malicious activities and accounts. In most cases, studies use features that do not capture temporal behavior and are approximated by the mean behavior, thereby, further inducing a bias in their study thus having high accuracy. Techniques that use large datasets and have high class imbalance, on the other hand, either have high recall and low precision or low recall and high precision [14]. Nonetheless, using our features, we identified ML algorithm that provides better precision as well as better recall.

We use Ethereum mainnet blockchain transaction data and first validate our assumptions and approach. We segment the transaction data into sub-datasets ($SD$) to capture the behavioral changes. We create the $SD$s using different temporal granularities ($T_{g}$ such that $T_{g}\in T_{G}$) where $T_{G}=\{Day$, $Week$, $Month$, $Quarter$, $HalfYearly$, $Year$, $All\}$. A granularity becomes coarser as we move from Day to Year. Here a $SD$ in a Day consists of transactions of 6000 blocks. The choice of 6000 blocks is based on the fact that in Ethereum approx 6000 blocks are created every day. At a coarser $T_{g}$, a $SD$ in a Week consists of 7 Days data. Similarly, a $SD$ in a Month consists of 30 Days data, a $SD$ in a Quarter consists of 3 Month data, a $SD$ in a HalfYearly consists of 6 Months data, and a $SD$ in a Year consists of 12 Months of data.

On all the features that are time series based (features described in section 4), we perform time series analysis of all the $SD$s at different $T_{g}$ to quantify them using tsfresh that “extracts characteristics from time series” [21, 22]. The analysis reveals that features such as quantile and median best describe the time series for most of the features we have. We observe this behavior not only in the entire dataset but also in different $SD$s at different $T_{g}$s.

We first apply the AutoML pipeline using TPOT [23] to identify the best ML classifier on the entire dataset and validate state of the art techniques. We configure TPOT with existing tested ML algorithms and their hyperparameters. Note that TPOT internally performs imputation and feature scaling also. Nonetheless, as our aim is to detect malicious accounts, we also apply clustering to identify accounts that show similar behavior to that of malicious accounts. For the entire dataset, we find that K-Means provides best silhouette score for $k=9$ when we consider both EOAs and SCs. For clusters identified as malicious, we use cosine similarity to quantify the similarity among the accounts within the cluster. We acknowledge that there are other methods as well to identify similarity, but for this work we use cosine similarity. With this method we are able to identify 293 more suspect accounts that have similar behavior as malicious accounts. When considering only EOAs, we identify best silhouette score at $k=10$ and 554 more suspects.

Assuming that K-Means with hyperparameter $k=9$ identified for entire dataset performs best for all temporal sub-datasets at different temporal granularities, we determine a probability for an account to be malicious at different temporal granularities. Across all temporal granularities we identify 814 unique accounts as suspects.

We do not describe the blockchain graph models as they are well understood. Instead, we directly present features that we extract from the blockchain temporal graph structure. The set of features ($F$) defined in the related work is limited and, in most cases, does not convey correct temporal behavior. We extend the feature set and introduce new features to detect malicious accounts. We follow a two-fold methodology to identify the relevant features. First, we study different attacks that have happened in the past to understand what features malicious accounts have used for malicious activity. Second, as most of the account features (for example, inDegree) are time series based, we perform time series analysis to identify features that best represent the salient properties of the relevant time series. Below we provide a list of all the features we use:

• •

  Non Time Series based (set $F_{n}|F_{n}\subset F$)

  • –

    Active state (AS): malicious activities are usually short-lived [5] and remain, for example, until remediation is introduced. It is thus essential that we consider features such as when the account first transacted (transactedFirst), last transacted (transactedLast), how long it has been active (durationActive), and since when the account is continuously transacting (activeSinceLast).

• •

  Time Series based (set $F_{t}|F_{t}\subset F$): We analyze each of the following time series based features using tsfresh [21, 22] and select 3 top features identified for each of the following attributes. Nonetheless, as inter-event time (IET) itself is a time series, we use it as a feature as well.

  • –

    inDegree (iD): it represents the number of transactions in which the account under consideration is a receiver at a particular instant. Most of the malicious activities involve transfer of money to a malicious account. Thus, it is one of the most important features used to understand the behavior of a malicious account. In [15], the author found that uniqueInDegree (defined as unique accounts from which the account under consideration has ever received money) to be one of the most critical feature for identification of malicious accounts. On top, we also use aggregated inDegreeAgg as a feature.

  • –

    outDegree (oD): represents the number of transactions in which the account under consideration has sent money at a particular instant. In some attacks such as Bitpoint Hack [24], after the attacker has received amount of sum from the victims in an alias account, they transferred the received sum to another account they hold or to an exchange. Such attacks increase the importance of outDegree as a potential feature. Similar to the case above, we also use aggregated outDegreeAgg as a feature.

  • –

    Balance (Bal): our motivation to use it as a feature is based on the fact that most malicious activities in a permissionless blockchains are finance based. For example, in one of the famous Parity Multisig wallets [25] attack the malicious account drained more than 150k Ethers (currency used in Ethereum blockchain). Thus the currency held by an account as well as its flow is an important feature. We identify balance time series for both in/out case. Besides balance, we identify for each instance max balance for both in and out cases (maxInBalance and maxOutBalance), zeroBalanceTransactions (transactions where no money was transferred either to or from an account), totalBalance (final balance held with the account), and averagePerInBalance (average of received balance) as features.

  • –

    Transaction Fees (TF): in crypto-currency based blockchains, a transaction is marked by transaction fees that a sender is willing to spend on a particular transaction. In Ethereum blockchain, operations like transferring Ethers require a fixed sequence of instructions which consume 21,000 Gas ($TF=Gas\times GasPrice$). Several attackers put higher gas price to bribe the miner so that a particular transaction of interest to them is included in the next block [19]. Nonetheless, in DDos attack [26], an attacker created multiple accounts at very low gas price to increase synchronization and processing time. Thus it is also an essential features.

  • –

    Attractiveness (A): mostly, malicious accounts tend to interact with accounts that they have not interacted with before. The probability of interacting with the same account that they have interacted before is very low. Consider $N_{i}^{t}$ to be the neighborhood (accounts with whom the account $i$ has received crypto-currency) of account $i$ at time $t$, $T=\{t,t-1,\cdots,t-\theta_{a}\}$, and $\theta_{a}$ the time window size. Based on this, we define attractiveness ($A_{i}^{t}$) for account $i$ at time $t$ as shown in equation 1.

    $$A_{i}^{t}=\begin{cases}1-\frac{\left|N_{i}^{t}\bigcap\left(\bigcup_{j\in T-\{t\}}N_{i}^{j}\right)\right|}{\left|\bigcup_{j\in T}N_{i}^{j}\right|},&\text{when }j\geq 0\text{ and }N_{i}^{t}\neq\emptyset\\ 0,&\text{otherwise}.\end{cases}$$

    (1)

• •

  Burst (BB) (set $F_{b}|F_{b}\subset F$): bursty behavior is defined as temporal non-homogeneous sequence of events [27] and has been characterized by a fat-tailed inter-event time ($\Delta t$) distribution. In one of the bitcoin blockchain attacks (Allinvain Theft [28]), a malicious account generated a large number of transactions to taint the bitcoin platform. Motivated by this incident, we define four types of bursts (temporal, degree, balance and gasPrice) that occur in the network under consideration. As an account can either be a sender or a receiver, the following burst types are defined for cases (a) when the account acts as a sender, (b) when the account acts as a receiver, and (c) when the account acts as both a sender as well as a receiver.

  • –

    Temporal Burst: for an account $i$, non-homogeneous occurrences of events (in our case transactions) lead to some transactions occurring where $\Delta t$ is less than a threshold, $\theta_{t}^{i}$, while for other transactions $\Delta t$ is large. If a transaction happens when $\Delta t<\theta_{t}^{i}$, we assume that it is a burst. Some burst can be long lived while some burst can be short lived, meaning, some event can happen continuously for long time intervals before going dormant. As features, we identify number of such temporal bursts (numberOfTemporalBursts) and the duration of the longest burst (longestBurstDuration) for both in and out transactions separately as well.

  • –

    Degree Burst: it has been proven that the degree (also inDegree and outDegree) distribution of the aggregated transactions in blockchain such as Ethereum follows a power-law (fat tailed) distribution [4] with $\alpha\in[-2.8,-2.6]$. This suggests that many accounts do not transact often while there are very few accounts that act as hubs (for example, exchanges). Nonetheless, when considering the temporal aspects, we believe such behavior also exists where some accounts have a very high degree for some instant while for other instants they have a low degree. Thus, we define a degree burst when at a given instant of time the degree of an account, $i$, is greater than $\theta_{d}^{i}$. Similar to the temporal case, for degree bursts we also identify number of degree bursts (numberOfDegreeBursts) that happened for an account over time, number of instances where the degree burst happened (numberOfDegreeBurstInstances), and the time at which the largest burst of degree happened (largestBurstAt). Note that these features except for numberOfDegreeBurstInstances are defined for both in and out transactions separately as well.

  • –

    Balance Burst: in some cases transactions happen from accounts $i$ to account $j$ where the involved sum of crypto-currency was very large (more than a threshold value $\theta_{b}^{i}$). For example, some accounts associated to Silk Road [29] or involved in money laundering sometimes transact large sum for illegal activities. Busty behavior of transaction amount could be helpful in identifying potential malicious activities and accounts. Similar to the above cases, for an account $i$, we identify number of unique instances where balance is more than $\theta_{b}^{i}$ (numberOfBalanceBurstyInstances), and number transactions more than $\theta_{b}^{i}$ (numberOfBalanceBursts). Note that, we define these factors for both only in and out case.

  • –

    GasPrice Burst: As described before, an attacker can put higher gas price (more than a threshold value $\theta_{g}^{i}$) to bribe the miner so that the transaction is included in the block. This activity although abnormal is useful in understanding account’s behavior. Towards this, similar to previous cases, we define numberOfGasPriceBurstyInstances as number of instances where the gasPrice was set more than $\theta_{g}^{i}$. This is only defined for in case as gasPrice is only set by the sender.

Note that features such as in/outDegree, burst, attractiveness are some graph-based temporal features. Besides these features, other graph-based properties that we use as feature includes clustering-coefficient (CC) [30]. For an account $i$, let $N_{i}^{t,in}$ be the neighborhood of account $i$ at time $t$ from which the account has received the crypto-currency, $N_{i}^{t,out}$ be the neighborhood of account $i$ at time $t$ to which the account has paid the crypto-currency. Thus, the total account degree is $deg_{i}^{tot}=|N_{i}^{t,in}|+|N_{i}^{t,out}|$. Let $N_{i}^{t,\leftrightarrow}=N_{i}^{t,in}\bigcap N_{i}^{t,out}$ and $a_{ir}=1$ if there is a transaction between $i$ and $r$, otherwise $0$. We similarly define $a_{is}$, $a_{ri}$, $a_{si}$, $a_{rs}$, $a_{sr}$. For a directed graph, CC of account $i$ ($CC_{i}^{t}$) at time $t$ is defined as equation 2 [31].

We evaluate the effectiveness of our method using Ethereum’s external transactions data which is publicly available for download using the Etherscan APIs [32]. Note that the APIs do not provide any information about the account (such as the name and the account type). Nonetheless, as the hash of the accounts is available, one can check the associated information using the Ethereum Blockchain Explorer [33]. We perform all our evaluations using Python.

Growth of blockchains technology and concept has found its implementation not only in the financial sector such as crypto-currency market, hedge-fund, and insurance but also in sectors such as governance, education, healthcare, and law enforcement. Although blockchains are privacy-preserving, with an increase in its adoption, security threats are inevitable, more diverse, and deployed using novel techniques. It is essential to have secure transactions. Motivated by the fact that there is limited work in identifying accounts involved in potential malicious activities and those available do not target temporal aspects of blockchains, in this work, we present a way to detect malicious accounts considering the temporal nature of the blockchains.

In this work, we present graph-based temporal features (such as burst and attractiveness) that are inspired by the existing attacks in the blockchain on top of existing features used to identify malicious accounts. To do so, we first conduct a systematic study of the temporal behavior of the blockchain graph on a collected transaction data in one of the blockchains called Ethereum. Our results show that ExtraTreesClassifier performs best under the supervised setting and achieves balanced accuracy $\in[87.2,88.7]$ for different dataset configurations. Moreover, under the unsupervised settings, K-Means was able to cluster max 73.9% known malicious accounts together and identify 554 more suspects that had similar behavior to that of malicious accounts. When considering behavioral changes over time and studying them over different temporal granularities, we are able to detect the probability of an account being malicious at a particular temporal granularity.

Given such results, we expect that benign accounts would be more careful while transacting with suspects and safe-guard themselves from any fraud and security threats. Nonetheless, the current technique is applicable to permissionless blockchain. We would like to investigate the applicability of our method to blockchains where features such as Transaction Fees and Balance are missing. Despite whether a particular blockchain is permissionless or permissioned, there are many other centrality measures such as closeness, betweenness and page-rank that are applicable in blockchain graph. One another future research direction is to incorporate these measures as features and study the behavior of the accounts before tagging them as malicious or benign. Nonetheless, in this work, we detected suspects using supervised learning and unsupervised learning algorithms. Reinforcement learning is another type of ML that can be applied and studied to detect malicious activity. As our validations failed on the newly tagged malicious accounts one perspective is to study new features and new methods that the new malicious accounts are using and deploying to perform illegal activities.

The authors declare that they have no competing interests.

RA, SB and SKS designed the research, RA and SB conducted experiments. All authors read and approved the final manuscript.

The list of 2946 malicious accounts used will be made available upon request. Nonetheless, list of all 4708 malicious accounts is publicly available on Etherscan and can be crawled using [36]. The Ethereum transaction Data is also public and can be downloaded using Etherscan APIs [32].

Not applicable.

This work is partially funded by the National Blockchain Project at IIT Kanpur sponsored by the National Cyber Security Coordinator’s office of the Government of India and partially by the C3i Center funding from the Science and Engineering Research Board of the Government of India.