Unified Feature Engineering for Detection of Malicious Entities in Blockchain Networks

Blockchain technology has been integrated into a wide range of applications in various sectors, such as finance, supply chain, health, and governance. However, the participation of a few actors with malicious intentions challenges law enforcement authorities, regulators and other users. These challenges revolve around dealing with an array of illegal activities such as asset trades in dark markets, receiving payments for cyber-attacks, and facilitating money laundering. Developing an efficient mechanism to identify malicious actors in blockchain networks is a pressing need to build confidence among the stakeholders and ensure regulatory adherence. The raw data of blockchain transactions do not readily reveal the dynamic behavioural changes and their interconnection between transactions and accounts. These behavioural patterns can be useful for identifying malicious actors. Machine Learning (ML)-based models for early warning and/or detection are considered one of the potential approaches. In ML, feature engineering plays a crucial role in enhancing the predictive performance of a model. This study proposes different categories of features and unified feature extraction approaches for raw Bitcoin and Ethereum transaction data and their interconnection information. As far as we are aware, there has been no study that considered a feature engineering approach for identifying malicious activities. The significance of the engineered features was validated against eight classifiers, including Random Forest (RF), XG-boost (XG), Silas, and neural network-based classifiers. The results showed that these features contribute to higher classification accuracy and higher Area Under the Receiver Operating Characteristic Curve (AUC) value for both Bitcoin and Ethereum transactions. This work also analysed the influence of engineered features in classification using the eXplainable Artificial Intelligence (XAI) technique SHapley Additive exPlanations (SHAP) values. The feature importance scores confirmed the significance of the proposed engineered features towards implementing classification models to identify, target and disrupt malicious activities in blockchain networks.