TEGDetector: A Phishing Detector that Knows Evolving Transaction Behaviors

• URL: http://arxiv.org/abs/2111.15446v1
• Date: Fri, 26 Nov 2021 02:54:47 GMT
• Title: TEGDetector: A Phishing Detector that Knows Evolving Transaction Behaviors
• Abstract summary: Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses' transaction behavior features by random walking or constructing static subgraphs. We propose TEGDetector, a dynamic graph that learns the evolving behavior features from transaction evolution graphs.
• Score: 8.123699164666602
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses' transaction behavior features by random walking or constructing static subgraphs. The random walking methods,unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address's transaction behaviors in different periods. Then, we provide a fast non-parametric phishing detector to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions towards a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learnt time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art detection performance.

Related papers

• Discovering Persistent Behavioural Patterns for Interpretable Blockchain Forensics [1.1059590443280727]
  This research proposes a scalable, application-agnostic framework for behavioural pattern discovery from large-scale blockchain activity.<n>It constructs sentences enriched with contract, token and market context, then applies a two-step embedding process.<n>An interpretable behavioural profiler characterizes communities through behavioural motifs, routines, temporal dynamics, entity exposure, and suspiciousness evidence.
  arXiv  Detail & Related papers  (2026-08-13T06:23:28Z)
• Temporal Motif-aware Graph Test-time Adaptation for OOD Blockchain Anomaly Detection [55.18577006122169]
  We propose a novel framework termed textbfTEmporal textbfMotif-aware textbfGraph textbfTest-textbfTime textbfAdaptation (textbfTEMG-TTA)<n>First, we comprehensively capture the 3-node temporal motif distribution of each active address using an efficient computational mechanism.<n>Second, we design a simple yet effective test-time adaptation strategy to facilitate the sharing of common patterns between training and testing graphs.
  arXiv  Detail & Related papers  (2026-05-28T07:43:20Z)
• PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System [6.068607290592521]
  We propose adaptive trace fetching, lightweight, real-time malicious behavior detection system. Specifically, we monitor malicious behavior with Event Tracing for Windows (ETW) and learn to selectively collect maliciousness-related APIs or call stacks. As a result, we can monitor a wider range of APIs and detect more intricate attack behavior.
  arXiv  Detail & Related papers  (2024-11-02T14:52:04Z)
• Transcending Forgery Specificity with Latent Space Augmentation for Generalizable Deepfake Detection [57.646582245834324]
  We propose a simple yet effective deepfake detector called LSDA. It is based on a idea: representations with a wider variety of forgeries should be able to learn a more generalizable decision boundary. We show that our proposed method is surprisingly effective and transcends state-of-the-art detectors across several widely used benchmarks.
  arXiv  Detail & Related papers  (2023-11-19T09:41:10Z)
• Transaction Fraud Detection via an Adaptive Graph Neural Network [64.9428588496749]
  We propose an Adaptive Sampling and Aggregation-based Graph Neural Network (ASA-GNN) that learns discriminative representations to improve the performance of transaction fraud detection. A neighbor sampling strategy is performed to filter noisy nodes and supplement information for fraudulent nodes. Experiments on three real financial datasets demonstrate that the proposed method ASA-GNN outperforms state-of-the-art ones.
  arXiv  Detail & Related papers  (2023-07-11T07:48:39Z)
• Blockchain Large Language Models [65.7726590159576]
  This paper presents a dynamic, real-time approach to detecting anomalous blockchain transactions. The proposed tool, BlockGPT, generates tracing representations of blockchain activity and trains from scratch a large language model to act as a real-time Intrusion Detection System.
  arXiv  Detail & Related papers  (2023-04-25T11:56:18Z)
• Evolve Path Tracer: Early Detection of Malicious Addresses in Cryptocurrency [6.9818380981710355]
  We present Evolve Path Tracer, which consists of Evolve Path LSTM, Evolve Path Graph GCN, and Hierarchical Survival Predictor. Specifically, in addition to the general address features, we propose asset transfer paths and corresponding path graphs to characterize early transaction patterns. We investigate the effectiveness and versatility of Evolve Path Tracer on three real-world illicit bitcoin datasets.
  arXiv  Detail & Related papers  (2023-01-13T06:59:52Z)
• Blockchain Phishing Scam Detection via Multi-channel Graph Classification [1.6980621769406918]
  Phishing scam detection methods will protect possible victims and build a healthier blockchain ecosystem. We defined the transaction pattern graphs for users and transformed the phishing scam detection into a graph classification task. The proposed multi-channel graph classification model (MCGC) is more able to detect potential phishing by extracting the transaction pattern features of the target users.
  arXiv  Detail & Related papers  (2021-08-19T02:59:55Z)
• Bandit Quickest Changepoint Detection [55.855465482260165]
  Continuous monitoring of every sensor can be expensive due to resource constraints. We derive an information-theoretic lower bound on the detection delay for a general class of finitely parameterized probability distributions. We propose a computationally efficient online sensing scheme, which seamlessly balances the need for exploration of different sensing options with exploitation of querying informative actions.
  arXiv  Detail & Related papers  (2021-07-22T07:25:35Z)
• Explainable Deep Behavioral Sequence Clustering for Transaction Fraud Detection [3.9505606841402607]
  We propose a Deep learning based behavior data representation method for Clustering (FinDeepBehaviorCluster) to detect fraudulent transactions. To utilize the behavior sequence data, we treat click stream data as event sequence, use time attention based Bi-LSTM to learn the sequence embedding in an unsupervised fashion, and combine them with intuitive features generated by risk experts to form a hybrid feature representation. Our experimental results show that the proposed FinDeepBehaviorCluster framework is able to catch missed fraudulent transactions with considerable business values.
  arXiv  Detail & Related papers  (2021-01-12T04:12:18Z)
• Real-Time Anomaly Detection in Edge Streams [49.26098240310257]
  We propose MIDAS, which focuses on detecting microcluster anomalies, or suddenly arriving groups of suspiciously similar edges. We further propose MIDAS-F, to solve the problem by which anomalies are incorporated into the algorithm's internal states. Experiments show that MIDAS-F has significantly higher accuracy than MIDAS.
  arXiv  Detail & Related papers  (2020-09-17T17:59:27Z)
• Change Point Detection in Time Series Data using Autoencoders with a Time-Invariant Representation [69.34035527763916]
  Change point detection (CPD) aims to locate abrupt property changes in time series data. Recent CPD methods demonstrated the potential of using deep learning techniques, but often lack the ability to identify more subtle changes in the autocorrelation statistics of the signal. We employ an autoencoder-based methodology with a novel loss function, through which the used autoencoders learn a partially time-invariant representation that is tailored for CPD.
  arXiv  Detail & Related papers  (2020-08-21T15:03:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.