title: Graph Modelling and Analysis for Detecting Illegal Activities in Blockchain Networks
Creators: name: Jeyakumar, Samantha T
Publisher: name: Griffith University
Year: 2024
Subjects: subject: blockchain network
subject: illegal financial activities
subject: graph modelling
subject: crypto-asset

description: Blockchain is a Distributed Ledger Technology (DLT) which enables decentralisation, transparency, immutability, and traceability for digital assets. Pseudoanonymity is one of the coveted features of blockchain, creates data gaps for regulators and can open unwanted doors for illegal financial activities such as money laundering, crypto payments for cyber crimes, and Ponzi schemes. While law enforcement authorities can trace transactions on public blockchains, they may encounter difficulties in identifying the actors linked to illegal activities. This calls for mechanisms to identify and understand the behaviour of illegal transactions to detect and disrupt corresponding payments. Efficient detection mechanisms will encourage the development of appropriate mitigation techniques such that financial regulations gain confidence to encourage the wide adoption of technology and secure digital assets-based transactions. The vast number of transactions and the pseudoanonymity nature of blockchain networks have made it challenging to detect illegal activities using traditional mechanisms and to deploy auditing approaches. The recent research works analyse blockchain transactions using structural properties of the transactions and the co-spending heuristics. These existing solutions were assessed for specific illegal activity and failed to leverage advanced data analysis based on the behaviour of actors connected in blockchain networks. Graphs have commonly been used to represent complex structures such as relationships in social networks, biological interactions, and knowledge bases. Graphs have the potential to explain the behaviour of entities via graph patterns. Graph-based analysis studies various behaviours of entities and networks and classifies them for different use cases. This study considered illegal financial transactions based on ransomware settlements, money laundering, dark markets-related trades, Ponzi schemes, and phishing settlements. The graphs corresponding with these illegal activities may inform the behaviour of the wallets, Externally Owned Accounts (EOAs), and smart contracts. Considering the potential of graph-based modelling and analysis, this research made three main contributions: 1) proposed a generalised graph modelling approach to represent Bitcoin and Ethereum networks as hypergraphs. These hypergraphs may also facilitate the end user to visualise the behaviour of the actors via graph patterns; 2) propose automated feature engineering approaches for creating various categories of features from the raw transaction data and their graphs; 3) provide a comprehensive analysis of the proposed feature categories' significance using supervised and unsupervised learning methods. The outcomes of the analysis considered identifying the influential features using an Explainable Artificial Intelligence (XAI)-based technique, Shapely values. It was found that through representing the blockchain network as a hypergraph we could effectively identify unique patterns of illegal activities. The identified patterns achieved detection rates of 90% for ransomware-related wallets, 95% for Ponzi scheme wallets, and 75% for Silk Road-related trades. Additionally, the hypergraph-based analysis improved the F1-score. The engineered structural and behavioural features combination shows a promising F1-score for ransomware settlement-related Bitcoin transactions and phishing activity-related Ethereum EOAs. Feature importance analysis also highlighted the engineered features as the top five most significant features. The combination of graph-based visualisation and analysis laid the groundwork to implement an interactive monitoring tool for law enforcement authorities, financial regulators, and forensic analysts. Future work will consider the temporal and dynamic aspects of the blockchain network graph in detecting illegal activities.