Multiscale Feature Fusion and Graph Convolutional Network for Detecting Ethereum Phishing Scams

Abstract

With the emergence of blockchain technology, the cryptocurrency market has experienced significant growth in recent years, simultaneously fostering environments conducive to cybercrimes such as phishing scams. Phishing scams on blockchain platforms like Ethereum have become a grave economic threat. Consequently, there is a pressing demand for effective detection mechanisms for these phishing activities to establish a secure financial transaction environment. However, existing methods typically utilize only the most recent transaction record when constructing features, resulting in the loss of vast amounts of transaction data and failing to adequately reflect the characteristics of nodes. Addressing this need, this study introduces a multiscale feature fusion approach integrated with a graph convolutional network model to detect phishing scams on Ethereum. A node basic feature set comprising 12 features is initially designed based on the Ethereum transaction dataset in the basic feature module. Subsequently, in the edge embedding representation module, all transaction times and amounts between two nodes are sorted, and a gate recurrent unit (GRU) neural network is employed to capture the temporal features within this transaction sequence, generating a fixed-length edge embedding representation from variable-length input. In the time trading feature module, attention weights are allocated to all embedding representations surrounding a node, aggregating the edge embedding representations and structural relationships into the node. Finally, combining basic and time trading features of the node, graph convolutional networks (GCNs), SAGEConv, and graph attention networks (GATs) are utilized to classify phishing nodes. The performance of these three graph convolution-based deep learning models is validated on a real Ethereum phishing scam dataset, demonstrating commendable efficiency. Among these, SAGEConv achieves an F1-score of 0.958, an AUC-ROC value of 0.956, and an AUC-PR value of 0.949, outperforming existing methods and baseline models.

Ethereum Phishing Scam Detection Based on Data Augmentation Method and Hybrid Graph Neural Network Model

“… LSTM [ 19 ] is specifically designed to address problems of gradient vanishing and explosion in long sequence data, suitable for processing sequences with long-term dependencies. A-CNN (Attention-CNN) [ 4 ] combines CNN and attention mechanisms to enhance CNN performance in processing sequence data, especially in tasks like text classification and sequence tagging. Node2Vec [ 16 ] is a graph embedding technique that maps nodes in a graph to low-dimensional vector spaces for subsequent machine learning tasks.…”

“…A-CNN (Attention-CNN) [ 4 ] combines CNN and attention mechanisms to enhance CNN performance in processing sequence data, especially in tasks like text classification and sequence tagging.…”

“…This tactic has also spread to the blockchain ecosystem [ 3 ]. Unlike traditional phishing scammers who prefer creating fake websites to gather users’ personal information, Ethereum scammers tend to entice victims to transfer Ether or grant permissions to phishing accounts, thereby obtaining substantial returns [ 4 ]. Research organizations have identified over 5000 phishing accounts in Ethereum, some of which have been active in the past two to three years, with stolen assets amounting to tens of millions of dollars [ 5 , 6 ].…”