Data Depth and Core-based Trend Detection on Blockchain Transaction Networks

TL;DR

InnerCore addresses the challenge of scalable, unsupervised analysis of large blockchain transaction networks to detect market manipulators and assess sentiment. It combines data-depth-based core decomposition with centered-motif analysis to identify influential addresses and alert on significant events, achieving fast runtimes on graphs with hundreds of thousands of nodes. The approach is validated on real-world events (LunaTerra collapse, Ethereum PoS switch, USDC peg loss), outperforming baselines and state-of-the-art dynamic-graph change detectors in detection accuracy and efficiency. This framework enables automated, explainable blockchain analytics at scale, with potential applications in risk monitoring and DeFi security.

Abstract

Blockchains are significantly easing trade finance, with billions of dollars worth of assets being transacted daily. However, analyzing these networks remains challenging due to the sheer volume and complexity of the data. We introduce a method named InnerCore that detects market manipulators within blockchain-based networks and offers a sentiment indicator for these networks. This is achieved through data depth-based core decomposition and centered motif discovery, ensuring scalability. InnerCore is a computationally efficient, unsupervised approach suitable for analyzing large temporal graphs. We demonstrate its effectiveness by analyzing and detecting three recent real-world incidents from our datasets: the catastrophic collapse of LunaTerra, the Proof-of-Stake switch of Ethereum, and the temporary peg loss of USDC - while also verifying our results against external ground truth. Our experiments show that InnerCore can match the qualified analysis accurately without human involvement, automating blockchain analysis in a scalable manner, while being more effective and efficient than baselines and state-of-the-art attributed change detection approach in dynamic graphs.

Figures (11)

• Figure 1: A running example to compare between the graph-$k$-core and AlphaCore decomposition methods. The Coreness of nodes according to graph-$k$-core decomposition is shown with different node colors, whereas AlphaCore is run with in-strength and out-strength as node features with a step size of 0.25. Different AlphaCores are shown using dotted boundaries.
• Figure 2: Flowchart of our methodology for identification of significant days and subsequent anomalous addresses.
• Figure 3: In a temporal graph (e.g., transaction network), changes in decay and expansion reflect varying levels of hope, despair, uncertainty, and faith in the asset being represented.
• Figure 4: Five 3-node motifs exhibiting buy and sell behaviors. Nodes labeled C denote the center where a center with an in-degree = 2 indicates buy behavior and an out-degree = 2 indicates sell behavior. Out of the 16 connected 3-node motifs (see Figure 1B in milo2002network), only the five given above (motifs 1, 4, 5, 6, and 11) contain a center node.
• Figure 5: Comparison between running times of AlphaCore with the starting $\epsilon=1.0$ and stepsize $s=0.1$, InnerCore with $\epsilon=0.1$ on daily Ethereum transaction networks to return the InnerCore of depth $<$ 0.1. An average of approximately 480,000 nodes (addresses) and 1 million edges (transactions) exist in each network. The average computation time is 4.06 seconds (max 8.1s), which is approximately 0.10 times the average computation time of AlphaCore, 0.12 times the average computation time of the highest graph $k$-core, and 0.14 times the average computation time of SCPD.

Theorems & Definitions (10)

• Definition 1: Mahalanobis depth to the origin (MhDO)
• Definition 2: Data Depth
• Definition 3: Mahalanobis (MhD) depth
• Definition 4: Expansion
• Definition 5: Decay
• Example 1: Expansion and Decay
• Definition 6: Node Frequency
• Definition 7: Inverse Appearance Frequency
• Definition 8: NF-IAF Score
• Example 2