TSGN: Transaction Subgraph Networks Assisting Phishing Detection in Ethereum

Due to the decentralized and public nature of the blockchain ecosystem, malicious activities on the Ethereum platform impose immeasurable losses on users. At the same time, the transparency of cryptocurrency transactions provides a unique opportunity to analyze illegal activities, such as phishing scams, from a network perspective. Most existing phishing scam detection methods focus primarily on analyzing account interaction networks, which limits their ability to uncover transaction behavior patterns embedded within transaction interactions. To address this, we construct the <u>T</u>ransaction <u>S</u>ub<u>G</u>raph <u>N</u>etwork (TSGN) by using transaction subgraphs as basic elements and further propose a novel framework for Ethereum phishing account detection. Specifically, we rebuild the graph structures via three well-designed mapping mechanisms, yielding TSGN and its two variants, i.e., Directed-TSGN and Temporal-TSGN, to obtain direction-aware and time-aware transfer flow features. By further incorporating the mapping strategy into transaction multidigraphs, we develop the Multiple-TSGN, which could preserve more transaction flow features while concurrently reducing the time consumption of modeling large-scale networks. TSGN models based on transaction subgraph interactions can capture complex higher-order dependencies, which lay beyond the reach of models that exclusively capture pairwise account interactions. As a general framework, our model can incorporate various feature extraction methods to improve the performance of phishing detection. Extensive experimental results on Ethereum datasets show that our method achieves superior performance in phishing detection, yielding 3.27%<inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula>6.71% relative improvement over previous state-of-the-art.