A graph neural network approach to cluster user behaviours in decentralized finance

Decentralised Finance (DeFi) applications involve a large volume of funds and exhibit diverse user behaviours, including malicious activities such as smart contract exploits and financial scams. Existing approaches struggle to capture complex behaviours. To address this gap, we propose a general Blockchain User Behaviour Analysis (BUBA) pipeline for DeFi security. The pipeline presents an automated action formation process that takes blockchain transactions as inputs and outputs user actions. In addition, BUBA introduces a dual Graph Neural Network (GNN) model that jointly captures user action features, contract and token interactions, and heterogeneous graph structure information to produce rich behavioural embeddings, enabling effective clustering of semantically meaningful user behaviours. We evaluate the proposed pipeline on Uniswap V3, where it outperforms baseline methods in identifying and differentiating suspicious behaviours. A further case study on Sushiswap V2 demonstrates the generalisability of the pipeline across DeFi applications. • A DeFi behavioural dataset that consists of raw transaction data, pre-labelled malicious addresses, uniquely generated actions that can describe user behaviour, and graph visualisation data. This dataset is the first of its kind and can be utilised as a benchmark for future blockchain behavioural analyses. • BUBA, a new blockchain user behaviour analysis pipeline that takes the raw transaction data as input and produces behavioural clusters that can describe behaviours like activity levels and suspicious activities. It includes a data collection step that gathers the raw transactions and pre-labels known addresses, an action formation part that presents how the events of the users’ transactions can be formed into unique, expressive actions that can describe and visualise the activities of all participants, a dual GNN model that produces unique embeddings for every user which can be utilised in the last step by a clustering algorithm which presents separate unique behavioural clusters that can be analysed to understand the included users’ behaviour in more detail. • An analysis of behavioural clustering results, their description, and evaluation by the pre-labelled address set and other features that highlight the usual behavioural patterns of normal and suspicious users. This includes the complete description of the unique characteristics of each resulting cluster label.