Phishing scams on the Ethereum network have become a serious threat, especially with the influx of new users into the cryptocurrency market. Current detection methods are mainly focused on long-term consistent transaction patterns with smooth temporal dynamics. However, these methods often struggle to differentiate between phishing and non-phishing users, whose behaviours may appear deceptively similar. Additionally, they face challenges such as network sparsity and data leakage, leading to significant performance limitations. To address these issues, we introduce TEMPER, a novel sequential learning framework designed to jointly capture the subtle distinctions between long- and short-term user behaviours and their correlations to provide more comprehensive insights. TEMPER effectively generates distinguishable user embeddings, enabling the accurate identification of phishing users. Unlike previous approaches, TEMPER mitigates data leakage through a novel sequential transaction sampling algorithm and addresses network sparsity with short-term temporal learning. Through extensive experimentation on three real-world Ethereum datasets, TEMPER demonstrates its efficacy by achieving a 3-4% improvement in the F1-Score compared to existing baseline models, representing a significant advancement in Ethereum phishing user detection.

Phishing scams on Ethereum have expanded with the surge of the platform, posing substantial challenges due to the sheer similarity in user behaviours and sparse temporal instances. Current methods often fail to tackle these concerns and overlook the temporal sequence of transactions, resulting in suboptimal performance. In this paper, we aim to address these gaps by focusing on the alignment of two aspects: (1) User-specific local temporal behavior, and (2) Divergences from global activity patterns of the network. Hence, we introduce CATALOG (CApturing joint TemporAl dependencies from LOcal and Global user behaviour), a novel representation learning model that jointly captures the local and global user behviours and their correlations by leveraging a dual cross-attention mechanism paired with a bi-directional Masked Language Modelling (MLM) transformer. Our proposed model simultaneously learns from local behavioral shifts, global market trends, and contextually enriched embeddings, effectively distinguishing phishing from non-phishing users while addressing existing research gaps. Extensive experiments on real-world Ethereum transaction data show that our framework improves phishing detection by 7-8% in the F1-Score along with demonstrating the generalization to Ethereum versions 1.0 and 2.0.

In recent years, the consequences of phishing scams on Ethereum have adversely affected the stability of the cryptocurrency environment. Numerous incidents have been reported that have resulted in a substantial loss of cryptocurrency. The existing literature in this area primarily leverages traditional feature engineering or network representation learning to recover crucial information from transaction records to identify suspected users. However, these methods mainly rely on handcrafted feature engineering or conventional node representation learning from a static network while ignoring the network dynamism and inherent temporal sparsity in the user behavior that results in underperformance after an extended period. This article proposes a novel sparsity-aware tensor decomposition-based architecture:SpaTeD, which retrieves efficient user representation utilizing the evolving transaction and structural information and subsequently mitigates the temporal sparsity problem. Our model is evaluated on a real-world Ethereum phishing scam dataset and reports a significant performance improvement over the baselines (96%recalland 96%F1-score). We have conducted an extensive set of experiments to verify the temporal robustness of the model. Additionally, we have provided the ablation study to demonstrate the contribution of each component of the framework.

The Ethereum blockchain platform has witnessed a surge in crypto-cybercrimes, particularly phishing attacks, resulting in significant financial losses. Analyzing the Ethereum transaction network to detect phishing users poses a set of critical challenges, including network sparsity, dynamic network fluctuations, large-scale data and significant class imbalance. Existing literature in this area primarily leverages traditional feature engineering or network representation learning to retrieve crucial information from transaction records to identify suspected users. However, these methods mainly rely on manually handcrafted features or conventional node representation learning while ignoring the inherent network sparsity and dynamic fluctuations. Hence, to alleviate these challenges, this paper introduces a novel tensor-based representation learning framework, TREAT (Temporal andRelationalAttention-basedTensor Representation Learning). TREAT models the Ethereum transaction network as a 3-dimensional tensor to preserve structural, transactional, and temporal aspects in a standalone architecture, thereby observing the rich correlation among these. The framework is coupled with a two-way self-attention mechanism alongside a rank-based tensor decomposition to comprehend the underlying evolving transaction interaction patterns while addressing the network sparsity. A Graph Neural Network layer with edge attention elevates the final representation quality, thereby yielding a 3%~4% improvement inF1-Scorewith respect to the existing baselines.

The recent surge of Ethereum in prominence has made it an attractive target for various kinds of crypto-crime. Phishing scams, for example, are an increasingly prevalent cybercrime in which malicious users attempt to steal funds from a user's crypto wallet. This research investigates the effects of network architectural features as well as the temporal aspects of user activities on the performance of detecting phishing users on the Ethereum transaction network. We employ traditional machine learning algorithms to evaluate our model on real-world Ethereum transaction data. The experimental results demonstrate that our proposed features identify phishing accounts efficiently and outperform the baseline models by 4% in Recall, and 5% in F1-score.