# MP-GCN: A Phishing Nodes Detection Approach via Graph Convolution Network for Ethereum
## 1 Introduction  
Blockchain is a distributed, open, public ledger that records information pertaining to transactions between two parties. It has garnered attention owing to its anonymity, non-repudiation, non-tamperability, and permanent storage [1, 2]. In 2009, [PERSON] launched the Bitcoin project, the first large-scale application of blockchain, and was the first to introduce cryptocurrency to the real world [3, 4]. Ethereum is one of the world's largest smart contract platforms, and Ether is the second-largest cryptocurrency in the world [3]. The anonymity of Ethereum allows cybercrime to occur easily because they cannot be convicted for cybercrimes in the real world easily [3]. Most notably, the Decentralized Autonomous Organization (DAO) hack in 2016 and the Parity Wallet hack in 2017 together caused more than $400 million in damages [5]. Phishing, a type of anomaly scoring network, is a cyber-fraud where a trusted organization (online bank, online retailer and so on) is impersonated to send fake emails and provide fake websites to users [6]. The victims often reveal their private information, such as credit card numbers, bank accounts, and ID numbers [7]. Typically, a phishing attack begins with an email sent to a victim that appears to be from a real organization [8]. Furthermore, this type of fraud can also happen in Ethereum through the transfer of irrevocable Ether through victims to the fraudulent sides [9]. In 2017, the Chainalysis Team were reported to account for more than 50% of all cyber-crimes in Ethereum [10]. The most representative example is the chess organization \"Bee Token\" incident in 2018, in which scammers defrauded approximately $1 million in 25 h [11]. To create a favorable investment environment for the Ethereum ecosystem, the Ethereum community must urgently identify an effective method for detecting and preventing phishing fraud. Previously, traditional phishing scammers disguised themselves as credible entities to steal users' sensitive information, such as usernames, passwords, and bank card information, such that they can then steal users' property [7]. Consequently, several methods of phishing detection have been proposed to reduce property loss, such as detecting the content of the emails and the information on the websites [12]. It is noteworthy that phishing fraud on Ethereum exhibits certain characteristics different from traditional phishing. First, phishers must exchange the illegally obtained cryptocurrency with real currency to gain profit. Second, the transaction records in Ethereum are publicly accessible, which provides a complete data source for determining the transaction methods of different Ethereum users, thereby facilitating phishing node detection. Finally, most traditional phishing frauds rely on emails and websites to obtain sensitive user information, whereas phishing frauds on Ethereum rely on more diverse sources, which allow phishing information to be spread in many forms [13]. Therefore, traditional phishing detection methods are insufficient to solve the phishing problem in Ethereum. We can see phishing network transactions in Ethereum occur in a certain direction, as shown in Figure 1. The phishing node is typically a node that accepts input from multiple nodes in a short duration and then transfers the amount to a specific node or nodes after obtaining a significant amount of money to transfer the stolen money rapidly and withdraw it, whereas the normal node interacts more frequently with its neighboring nodes and trades the received money with its neighbors. No reverse interaction with input nodes is becoming a visual feature of phishing nodes. Figure 1 is the transaction flow plotted from the first-order neighborhood nodes, which are directly connected nodes with an edge. We drew it based on our experimental data. In the ethereum network, a node represents an address.