Facilitating Feature and Topology Lightweighting: An Ethereum Transaction Graph Compression Method for Malicious Account Detection

TL;DR

The paper addresses scalable malicious-account detection on Ethereum by introducing TGC4Eth, a dual compression framework that reduces both feature dimensionality and transaction-graph topology. It constructs a robust feature set from prior studies, selects low-importance features via LightGBM to resist feature evasion, and applies graph focusing followed by graph coarsening to yield a lightweight, connected graph for GNN-based detection. Empirical results show substantial data-scale reduction (from tens of millions of nodes to hundreds of thousands) with preserved connectivity and improved robustness of GNNs to feature-evasion attacks, while classical ML methods suffer more under feature compression. The work demonstrates that feature and topology lightweighting can enhance detection efficiency and robustness in large-scale blockchain analytics, though it acknowledges optimization and downstream-model tailoring as future directions.

Abstract

Ethereum has become one of the primary global platforms for cryptocurrency, playing an important role in promoting the diversification of the financial ecosystem. However, the relative lag in regulation has led to a proliferation of malicious activities in Ethereum, posing a serious threat to fund security. Existing regulatory methods usually detect malicious accounts through feature engineering or large-scale transaction graph mining. However, due to the immense scale of transaction data and malicious attacks, these methods suffer from inefficiency and low robustness during data processing and anomaly detection. In this regard, we propose an Ethereum Transaction Graph Compression method named TGC4Eth, which assists malicious account detection by lightweighting both features and topology of the transaction graph. At the feature level, we select transaction features based on their low importance to improve the robustness of the subsequent detection models against feature evasion attacks; at the topology level, we employ focusing and coarsening processes to compress the structure of the transaction graph, thereby improving both data processing and inference efficiency of detection models. Extensive experiments demonstrate that TGC4Eth significantly improves the computational efficiency of existing detection models while preserving the connectivity of the transaction graph. Furthermore, TGC4Eth enables existing detection models to maintain stable performance and exhibit high robustness against feature evasion attacks.

Figures (5)

• Figure 1: Overall framework of TGC4Eth.
• Figure 2: The importance of the manual transaction features derived by LightGBM.
• Figure 3: The illustration of initial transaction graph and different types of accounts.
• Figure 4: A framework for graph structure compression, including graph focusing and graph coarsening. The meaning of nodes and edges is the same as in Fig. 3.
• Figure 5: Performance under feature random removal and evading attack.