# MP-GCN: A Phishing Nodes Detection Approach via Graph Convolution Network for Ethereum
## 3 Method
### Phishing Detection Framework  
To solve the phishing detection problem, we propose a framework, depicted as the flowchart in Figure 2. The phishing detection framework proposed herein comprises the following main components:  
(1) Data Acquisition: Based on transaction records, we set the addresses are labeled as phishing addresses and normal addresses. These nodes are connected to their first-order neighbor nodes by edges. The first-order neighbor nodes of a vertex are the nodes directly connected to it with an edge, which in this experiment is a node that makes at least one transaction with the central node. A transaction record can be described as a quadruplet (S, R, T, B), which indicates the transaction initiator, i.e., a sender (S), who sends ethers (B) to the receiver (R), at time (T).  
(2) Build the transaction network: Based on the data obtained, we build the transaction network by the transaction records because neighboring nodes will have similar embedding [37]. Every labeled node is connecting its first-order neighbor nodes with an edge. Each node is labeled, and each edge contains the transaction amount.  
(3) Graph embedding: Graph embedding is an approach to transform nodes, edges, and their features into vector space (a lower dimension) [17]. Deepwalk [38] and Node2 vec [39] obtain the wandering sequence by wandering nodes. The sequence is obtained by the word2 vec model to obtain the the embedding of nodes. In message passing, as in Equation (1), by multiplying the embedding of the first-order neighbor nodes and the weights of the edges, we obtain the the value of a message. The messages flow in the same direction as the transaction, from node S to node R. We obtain the embedding of the central node by aggregating all received message values. Combining the features of the neighboring nodes of a node is used to generate the features of that node, which is the method used for convolution in the spatial domain [40].  
\[f_{i}=\max_{j\in N(i)}(f_{j}*W_{i,j}) \tag{1}\]  
where \(W_{i,j}\) is the weight between node \(i\) and node \(j\). \(f_{i}\) is the embedding of node \(i\), and \(N(i)\) means the neighbor nodes of node \(i\). In the end, every node aggregates its neighbor nodes as well as the network structure to obtain the embedding of the node.  
Figure 2: Framework of Phishing detection.  
(4) Detection: Based on the calculated node embedding values as the nodes' feature, we randomly select 80% labeled nodes and their first-order neighbors as training samples and the rest as test samples to test our phishing detection model. We only use the classification values of the labeled central nodes for comparison with the labeled values of the nodes.  
First, we construct a large-scale Ethereum transaction network with labels by combining transaction records; subsequently, we randomly initialize the node embedding values and denote the embedding dimension of each node by d, to be used as the input to the model. After message passing, we obtain the embedding of the graph and nodes. After obtaining the embedding value of each node, we use GCN as the supervised learning method to train our model by fitting the embedding to the labeled data. After training, we validated the performance of the model with a test set based on the trained model.