## 1 Introduction
Results could highlight which entities show relatively consistent behavior from batch to batch (making them less likely to be affected by illicit activities and narrowing down the time interval necessary to obtain \"typical\" entity behavior) and which entities show strongly varying behavior over time (thus revealing short-term changes in behavior that could suggest suspicious network activities or sensible targets). We believe that our novel approach could be valuable for future forensic tools as it may highlight the importance of considering blockchain data as a time-series to reveal short-term behavioral changes, hence shifting the paradigm of forensic blockchain analysis from a \"macro\" or \"black-box\" approach towards taking into account network micro-dynamics. As a byproduct, these considerations can reduce the complexity and the required resources for forensics analysis. Specifically, the present analysis is based on extending cascading machine learning concepts presented in [PERSON] et al. [10], which essentially apply ensemble learning and stacking of several classifiers trained with different datasets derived from blockchain data. The idea behind this technique is to classify Bitcoin entities using prior classification information, combine them with new blockchain-derived data, and then compute a final classification to improve predictive performance. All data were normalized with respect to the considered batches (time-intervals). This operation allows us to generalize the derived classifiers and use them with data from different sources or from other blockchains, which increases transferability of our results. We carry out four experiments considering different batch sizes, where a cascading approach with data extracted from blockchain batches is used. We started using a batch size of 60,000 consecutive blocks (approx. 12 months of data); in the second experiment we used 30,000 consecutive blocks (approx. six months of data); in the third experiment we chose 20,000 consecutive blocks (approx. four months of data), and in the last experiment we used 10,000 consecutive blocks (approx. two months of data). In each experiment, we used one batch to train the initial classifiers, meanwhile the others--left out from training--were used to test them. This procedure is repeated for each batch extracted from the blockchain until each one has been used once for training (\"k-fold cross-testing\"). These tests allow us to analyze similarities between entity behavior over time and investigate if certain behavioral patterns are repeated across different blockchain batches. We consider six different types of Bitcoin entities: Exchange, Gambling, Marketplace, Mining Pool, Mixer, and eWallet. At the end of the four experiments, following previous studies [4; 13] that considered Mining Pool entities as sensitive targets (potentially subject to cyber-attacks), a deeper analysis of Mining Pool behavior is shown. The rest of the paper is organized as follows. Section 2 describes related work. Afterwards, Section 3 presents an overview of the used data. Section 4 introduces the graph models and the machine learning models implemented; then, in Section 5, the experimental analysis is presented. Finally, in Sections 6 and 7, we draw conclusions and provide some guidelines for future work.