Identifying Suspicious Blockchain Transactions using Clustering with Explainability

Blockchain is a distributed ledger technology that provides pseudo-anonymity among participants to maintain privacy. However, malicious actors utilise this property to hide their illegal rewards received through cyber attacks, dark market trades, money laundering, and Ponzi schemes. The recent confiscation by the FBI of more than $4 million USD worth of bitcoin from the ‘Silk Road’ dark marketplace indicates the scale of the problem faced by financial regulators and law enforcement authorities. Analysing and identifying harmful actors is, therefore, necessary to regulate the transactions of digital assets. Machine learning models can assist in detecting patterns and correlations between the actors in blockchain networks that may not be apparent through traditional methods. In blockchain networks, the number of actors linked to illegal activities is significantly smaller than that of regular activities. Also, only very limited labelled transaction data is available about these malicious actors. These limitations make it harder to train supervised learning models to provide real-time proactive responses. This paper represents a pioneering effort in thoroughly examining the different unsupervised learning methods for clustering suspicious behaviour of actors within blockchain networks. The proposed unsupervised learning-based analysis considers metadata and interconnectivity information of blockchain transactions. The metadata contains time-based and amount-based information. Interconnectivity data represents centrality measures and embedding vectors of the blockchain network. The quality of the identified clusters is validated using internal and external cluster validation measures. The validation results were used to identify influential features using the eXplainable AI technique Shapley (ShAP) values. The results reveal that the features related to the spending and receiving transactions strongly influenced cluster identification. Overall, the centroid-based and connectivity-based approaches identified well-separated clusters for metadata and centrality-based features of blockchain transactions.