## 4 Methodology
### Cascading Machine Learning  
In this study, we used and extended the cascading machine learning concepts introduced in [10], which have shown excellent classification results when using the whole blockchain data. As mentioned in Section 2, the cascading machine learning optimizes the number of features used in the classification and ensures high accuracy value, comparing them with output accuracy of other techniques [10]. Our cascading model is a type of ensemble learning applying stacking techniques [46]. The idea transferred to the Bitcoin network is based on enriching Bitcoin entity data with information obtained from prior classifications creating cascading classifiers, as shown in Figure 3.  
The first step to create the cascading system was to split the address, 1_motif and 2_motif dataframes into train/test datasets. In particular, this operation was computed using a proportion of 50/50. Then, the created train datasets were used to implement the weak classifiers called C_address, C_motif1 and C_motif2 in relation with their own input data (zero-level in Figure 3). This process was computed by applying a k-fold cross-validation with k = 5. In k-fold cross-validation, the dataset is  
Figure 3: Cascading machine learning architecture. divided into \(k\) folds, where \(k-1\) folds are used for training the model and the one left out during the training phase is used to validate it. The whole process is repeated until each fold is used only once for validating. Once the cross-validation was ended and the models were generated/trained, the test dataset was used as input. The output of the classification from the Level 0 classifiers was joined with the information in the entity dataframe in order to create the enriched entity dataframe. Then, this new enriched dataframe was used for training the final (strong) classifier called _C_final_ (first-level in Figure 3). Thanks to the initial dataset split into train and test, the information generated from the weak classifiers was created from a completely unseen dataset. In fact, if the data that were used to train the zero-level learner were also used to generate the enriched dataset for training the first-level learner, there would be a high risk of overfitting [47], which hence has been avoided here. The outgoing information from the zero-level classifiers was processed following an enrichment process, as indicated in [10]. This process consists of assigning one of the six possible output classes to each entry in the input dataframe and joining the input label (from WalletExplorer) with the computed output class. Then, the input label was grouped counting how many times a sample belonging to a particular entity has been detected in each of the considered classes. This value was then normalized as indicated in Equation (4), where \(E\) represents the entities set and \(N\) is the number of considered classes (\(N=6\) in this study). The term \(\parallel P_{e|\;\parallel}\) represents how many times a sample originally labelled with entity \(e\) generates a prediction belonging to class j, while the term \(\sum_{i=1}^{N}\parallel P_{e|\;\parallel}\) counts all the predictions generated from samples with labelled input belonging to entity \(e\):  
\[\forall e\in E\qquad\frac{\parallel P_{e|\;\parallel}}{\sum_{i=1}^{N} \parallel P_{e|\;i}\parallel}*100\qquad\textit{with}\quad j\in N. \tag{4}\]  
Finally, the enrichment process allows us to generate a set of six new features from each weak model, which were used to enrich (extend) the entity dataframe extracted from blockchain data. In this paper, we implemented the first three classifiers (weak) as Random Forest (RF) and the final one as Gradient Boosting (GB) model, since such implementation has been shown to yield good classification performance in terms of Precision, Recall, and F1-score for entity classification [10]. Specifically, all Random Forest models were implemented with the number of estimators set to 10, with a Gini function to measure the quality of the split and without a maximum depth of the tree.