Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding (1911.09259v2)

Abstract: Recently, blockchain technology has become a topic in the spotlight but also a hotbed of various cybercrimes. Among them, phishing scams on blockchain have been found making a notable amount of money, thus emerging as a serious threat to the trading security of the blockchain ecosystem. In order to create a favorable environment for investment, an effective method for detecting phishing scams is urgently needed in the blockchain ecosystem. To this end, this paper proposes an approach to detect phishing scams on Ethereum by mining its transaction records. Specifically, we first crawl the labeled phishing addresses from two authorized websites and reconstruct the transaction network according to the collected transaction records. Then, by taking the transaction amount and timestamp into consideration, we propose a novel network embedding algorithm called trans2vec to extract the features of the addresses for subsequent phishing identification. Finally, we adopt the oneclass support vector machine (SVM) to classify the nodes into normal and phishing ones. Experimental results demonstrate that the phishing detection method works effectively on Ethereum, and indicate the efficacy of trans2vec over existing state-of-the-art algorithms on feature extraction for transaction networks. This work is the first investigation on phishing detection on Ethereum via network embedding and provides insights into how features of large-scale transaction networks can be embedded.

• The paper presents a novel network embedding technique, trans2vec, to extract unique features from Ethereum’s transaction network for phishing detection.
• It combines trans2vec with a one-class SVM to effectively classify phishing and non-phishing addresses based on transaction amounts and timestamps.
• Experimental results show that the proposed method achieves higher precision, recall, and F-score compared to state-of-the-art algorithms, enhancing blockchain security.

Analyzing Phishing Scam Detection on Ethereum via Network Embedding

The paper "Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding" explores the emergent threat of phishing scams within the blockchain ecosystem, specifically targeting Ethereum. With the rise of blockchain technology, Ethereum, which supports the second-largest cryptocurrency, ether, has seen a surge in various cybercrimes, notably phishing scams which make up over 50% of cybercrimes on this platform. This paper focuses on enhancing the detection mechanisms of such scams by leveraging network embedding and machine learning techniques to classify phishing addresses within Ethereum's transaction network.

Overview of the Proposed Method

The paper's central innovation is the utilization of a network embedding algorithm, trans2vec, which extracts features from Ethereum’s transaction records. This approach moves beyond traditional phishing detection methods, which often focus on textual content from emails and websites. Instead, it leverages the nature of blockchain’s complete and publicly accessible transaction records, making it possible to analyze the transaction behavior of different Ethereum users.

The process begins by gathering labeled phishing addresses from authoritative sources and reconstructing Ethereum’s transaction network. The trans2vec algorithm is then employed to embed these network features, incorporating transaction amounts and timestamps which provide crucial context about transaction relationships. Subsequently, a one-class support vector machine (SVM) is used to classify nodes into phishing and non-phishing categories.

Experimental Results and Performance

The results from extensive experiments indicate that trans2vec outperforms state-of-the-art algorithms in feature extraction for Ethereum-like transaction networks. Key performance metrics such as precision, recall, and F-score affirm the high efficacy of this method. Notably, the trans2vec method exhibits robust performance across a range of embedding dimensions, highlighting its versatility and adaptability to large-scale data inherent in blockchain networks.

Implications and Future Directions

The implementation of network embedding provides a nuanced method to detect phishing, allowing for identification within highly imbalanced and heterogeneous datasets like those of Ethereum. Although this paper focuses on phishing detection, the methodological framework and insights can potentially be generalized and applied to other types of fraud or illicit behaviors in blockchain networks.

The paper lays a foundation for future exploration into more comprehensive network embedding models tailored for blockchain environments, potentially enhancing the detection capabilities across various scams beyond phishing. Additionally, it signifies the necessity for ongoing refinement of classification systems to adapt to evolving scam tactics and the dynamic nature of transaction networks.

Conclusion

This paper marks a significant step in addressing cybercrime on blockchain platforms, specifically targeting the pervasive issue of phishing scams on Ethereum. By focusing on network embedding and leveraging machine learning in a novel manner, the researchers present a viable and effective solution to improving the security and integrity of blockchain systems. This work not only reinforces the potential of advanced computational techniques in cybersecurity but also encourages continued innovation in safeguarding digital ecosystems against complex threats.