Temporal Analysis of Transaction Ego Networks with Different Labels on Ethereum

Etherscan is one of the most widely used Ethereum browsers, recording lots of account labels that are reliably provided by multiple users. A lot of previous research work on Ethereum also used the labeled accounts on Etherscan [16] [17]. We choose six types of the most common and important accounts on Ethereum as the targets. Especially, according to the crime report about cryptocurrency [18], ponzi schemes and phish scams have defrauded millions of dollars. Now we will introduce the definition of these accounts in detail.

• $\bullet$

  ICO: The accounts used to receive crowdfunding for the initial offering of the tokens

• $\bullet$

  Mining: The accounts of miners who participate in block mining

• $\bullet$

  Gambling: The accounts of the gambling platforms

• $\bullet$

  Exchange: The accounts of exchanges that allow users to sell or buy cryptocurrencies

• $\bullet$

  Ponzi: The accounts related to the manipulator of ponzi schemes

• $\bullet$

  Phish: The accounts related to the manipulator of phish scams

In addition, we collect all target labeled accounts as well as their complete $Ether$²²2$Ether$ is the official cryptocurrency of Ethereum. transaction records. In order to construct the ego network, we also collect the transactions between their first-order neighbors. These transaction records are extracted from the latest Ethereum dataset on XBlock³³3http://xblock.pro/xblock-eth.html, which is a blockchain data platform. Therefore, a total of 2584 accounts and nearly 38 million transaction records are collected.

Let $G=(V,E)$ represents the ego network of an Ethereum account, where $V$ represents the set of nodes, and $E$ is the set of edges. $V$ contains the central node “EGO” and its neighbor nodes “ALTER”. The transactions between EGO and ALTER nodes, ALTER and ALTER form the edge set $E$. Particularly, an edge can be represented as $e=<u,v,w,t>$, indicating that at time $t$, account $u$ transfers Ether of amount $w$ to account $v$. Consequently, the ego network in our work is a weighted directed network.

Fig. 1 shows an example of an ego network. Moreover, we construct an ego network for each labeled account, classify the ego networks of the same label into one category, and take the average of various statistics as the final feature value of the label accounts. The details of each feature will be shown in the next section.

The local clustering coefficient is a measure of the degree to which the neighbors of the central node in the graph tend to cluster together. Let $G_{i}=(V,E)$ represents the ego network whose ego is node $i$. Here the edge of node $u$ pointing to node $v$ is written as $e_{uv}$. Then $N_{i}$ represents the neighbor nodes of node $i$ and $k_{i}=|N_{i}|$. Hence the local clustering coefficient of node $i$ is:

Then we calculate the average local clustering coefficient of each type of ego network, and the results are shown in Table I. According to the table, the probability of transactions occurring between the neighbors of ICO accounts is about 18$\%$, followed by Mining accounts and Exchange accounts. It tells us there is a higher probability that investors of ICO accounts will have transactions with each other. The coefficient of Gambling accounts is the smallest, which means the users participating in the gambling are generally not connected. Besides, the local clustering coefficient of Phish accounts is larger than that of Ponzi accounts, indicating that the neighbors of Phish accounts are also more likely to be connected. We speculate that there are fixed fraud partners in phishing activities.

For an Ethereum account $u$ with $M$ transactions, we define its life cycle as $Life_{u}=t_{M}-t_{1}$, where $t_{M}$ represents the time when the last transaction occurred and $t_{1}$ represents the time when the first transaction occurred. We count the life cycles of each kind of account and record its median and maximum values in Table II. It can be concluded that the life cycle of illegal accounts is much shorter than that of normal accounts, and their life cycle is less than 20 days. This is because the criminals usually transfer the illegal gains out of the accounts as soon as possible and no longer use the original accounts to enhance anonymity.

Afterwards, in order to observe the ego network of each type of label from a dynamic perspective, we refer to the previous work [12] and consider two types of time windows, the sliding window and the incremental window. Firstly, we take $1/5$ of the life cycle of each type of labeled account as a fixed time span $T$, which is also the initial length of the two time windows. The sliding distance of the sliding window is $T$ each time, while the size of the incremental window increases by $T$. Next, we use different time windows to extract transaction details of the egos, and obtain different characteristics in five phases.

In order to study the transaction activities of different types of accounts, we compare the evolution in the number of transactions between EGO and ALTER nodes during their life cycles in the incremental window mode. It can be seen from Fig. 2 that the number of transactions of illegal accounts is less than that of the normal accounts. In addition, the number of transactions on Exchange, Mining and Gambling accounts is relatively large. Because Exchange accounts are an intermediary on Ethereum, they generate a lot of transactions with users to buy and sell tokens. According to the description on Etherscan, we can know that Mining accounts are mining pools composed of many miners. So they usually return bonuses to miners multiple times. Additionally, Gambling accounts representing a kind of entertainment activity, also attract lots of users. Significantly, the curves of ICO accounts and Ponzi accounts are relatively similar, which shows that they have certain commonalities in the trading pattern. We presume that it is one of the reasons why it’s difficult for users to distinguish whether the investment project is a scam or not.

For the purpose of further exploring the roles of the labeled accounts on Ethereum, the changes in the ratio of two kinds of transactions (in/out) in the incremental window mode are also recorded. An in-transaction is an interaction in which the EGO receives Ether, and an out-transaction is an interaction in which the EGO transfers Ether to another account.

The results in Table III show that only Mining, Exchange, and Ponzi accounts have a higher proportion of out-transactions than in-transactions. We suppose that the reasons for this phenomenon are as follows. Firstly, the rewards obtained from mining blocks will be distributed to users who invest in miners, which is a long-term stable mechanism. Secondly, when an Exchange account is used as the initiator of transactions, it means that users are buying Ether from this platform. Generally speaking, investors will continue to purchase Ether multiple times and then sell them all at the highest price point. And thus Exchange accounts have more in-transactions than out-transactions. Thirdly, a Ponzi account intends to act like a normal project at first to attract more people. Then, a small part of the investment of latecomers will also be used as bonuses to return to the initial users several times.

Moreover, the in-transaction ratio of ICO accounts is relatively large at the initial phase of token issuance, and the later transaction volume gradually decreases. The other two kinds of accounts with a higher proportion of in-transactions are Gambling and Phish. A gambling activity is a game where the dealer makes a profit, so the number of users who win money is less than the total number of participants. Phish accounts are fraudulent, so they deceive multiple users to obtain Ether, and then transfer out all the illegal gains at the final phase.

Besides the number of transactions, the transaction amount is also an extremely important feature. Therefore, we observe the transfer amount of Ethereum accounts at each phase in the sliding window mode, and analyze the difference and essence. It can be seen from Fig. 3 that ICO accounts initially receive a large amount of investment and then gradually transfer it to the token-related accounts. Interestingly, the total amount transferred out from Mining accounts is always greater than the total amount transferred in, because most of the balance in the accounts comes from mining rewards. These rewards are not be recorded in the transactions, but they can be queried through the Ethereum browser. In addition, when no player participates in gambling games, Gambling accounts will transfer the balance out, indicating that Gambling accounts are essentially a profitable entity. In general, only the transfer-in and transfer-out amount at all phases of Exchange accounts are basically the same, which also reflects the role of Exchange accounts as an intermediary for the sale of tokens. Finally, we find that both types of illegal accounts have reaped huge profits, which means it’s urgent to identify and combat fraudulent accounts on Ethereum. It is worth noting that Phish accounts usually transfer out a large amount of Ether in the final phase. While Ponzi accounts transfer Ether out in batches, and some Ether will be returned to investors.