## 5 Results  
In this paper, we present an analysis for evaluating similarity between behavioral patterns of Bitcoin entities using cascading machine learning. The presented process introduces a \"temporal view\" of the blockchain data aiming to evaluate short-term changes in Bitcoin entity behavior. The approach consists of dividing the whole blockchain into several batches, in order to reduce the complexity of the problem, reducing the amount of data, simplifying the implemented models, and increasing the transferability of the solution. In order to unveil behavioral patterns in the Bitcoin network and study how the size of the batches affects the final classification, four experiments are presented. Each experiment was achieved with a different value of batch size, respectively with 60,000 blocks (approx. 12 months), 30,000 (approx. six months), 20,000 (approx. four months) and 10,000 blocks (approx. two months). The discovered behavioral patterns were divided into six classes: Exchange, Gambling, Market, Mining Pool, Mixer, and eWallet. Figures 5 and 6 show the F1-score calculated in each experiment separated per class. In particular, in each graph, the \(x\)-axis represents the number of batch used to train the models and the \(y\)-value  
Figure 4: Example of k-fold cross-testing applied with k = 3.  
represents the F1-score computed using \"k-fold cross-testing\" (Section 4.5). The F1-score values are shown with their own standard deviation. Figure 5: F1-score computed in the four presented experiments with different batch_size for Exchange, Gambling, and Market classes. The graphs in Figures 5 and 6 indicate that Exchange, Gambling, and eWallet behavior are only slightly affected by the chosen batch size. In fact, decreasing the batch size, the average F1-score over samples belonging to these three classes is weakly increased. At the same time, smaller batch size penalizes the ability of the models to discover Mixer and Market elements and generates strong changes in the detection of the Mining Pool class. Behavioral changes of those Mining Pools become visible when decreasing the batch size to \(20,000\) blocks, for example. These trends are confirmed in Table 3, where the overall average F1-score and standard deviation are reported for each experiment. One can observe that reducing the batch size slightly increases the detection of Exchange and Gambling elements. In particular, considering data from 10,000 blocks  
Figure 6: F1-score computed in the four presented experiments with different batch_size for Mining Pool, Mixer, and eWallet classes. (fourth experiment), F1-score values of 0.72 and 0.39, respectively, were reached. However, the batch size reduction also increases the variability of the classification, generating high standard deviation values for four of the six considered classes. The highest values of standard deviation are obtained for classifying Mining Pool and Market elements. These two classes generate a standard deviation of 0.218 for a F1-score value of 0.29, and 0.112 for a F1-score value of 0.08, respectively. The results shown in Figure 6 and Table 3 motivated us to analyze more in-depth the strong changes that could be observed in the Mining Pool class detection, which, following our initial idea, relate to changes in behavioral patterns that only become visible when reducing the batch size. For batch size 20,000, for example, Mining Pool behavior trained with temporal batch 7 yielded on average much better classification results than the model trained on other batches. This shows that the Mining Pool behavior captured in batch 7 is more representative than the behavior defined in all other batches. Figure 7 shows detailed associations among F1-score, recall, precision, and normalized number of samples for the Mining Pool behavior for each batch and batch size as Radar graphs.