High- and Low-order Transaction Aggregation Graph Network for Ethereum Phishing Detection

Phishing scams represent a significant criminal activity on Ethereum, driving the need for effective detection methods. The methods based on graph neural networks(GNNs) make significant breakthroughs due to their ability to model complex transaction networks. However, existing approaches often overlook the heterogeneity of Ethereum’s transaction graph during neighbor nodes aggregation. These methods typically focus on low-order neighbors, disregarding high-order ones, which limits their overall performance. To this end, we propose the High- and Low-order Transaction Aggregation Graph Network(HLTAG), which separately aggregates high- and low-order features for more effective feature representation. Specifically, we utilize biased random walk to aggregate low-order neighbors. We employ path aggregation to handle high-order neighbors. To mitigate the influence of noise and redundant information from high-order neighbors, we introduce a combination of attention decay, node similarity, and path attention mechanism, which dynamically adjust the aggregation weights. Extensive experiments demonstrate that HLTAG (94.4% Recall and 89.3% AUC) outperforms the state-of-the-art approaches in detecting Ethereum phishing scams, and exhibits significant advantages in large-scale scenarios.