# Detecting Malicious Accounts in Permissionless Blockchains using Temporal Graph Properties

arXiv: https://arxiv.org/abs/2007.05169 · HTML: https://mlsanity.com/paper/2007.05169/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jul 2020.

## Built on by (most cited first, 8 of 8)

- [Demystifying Fraudulent Transactions and Illicit Nodes in the Bitcoin Network for Financial Forensics](https://mlsanity.com/paper/2306.06108/) (2023)
- [Detecting Malicious Accounts showing Adversarial Behavior in Permissionless Blockchains](https://mlsanity.com/paper/2101.11915/) (2021)
- [Identifying malicious accounts in Blockchains using Domain Names and associated temporal properties](https://mlsanity.com/paper/2106.13420/) (2021)
- [Towards Malicious address identification in Bitcoin](https://mlsanity.com/paper/2112.11721/) (2021)
- [textscPerseus: Tracing the Masterminds Behind Cryptocurrency Pump-and-Dump Schemes](https://mlsanity.com/paper/2503.01686/) (2025)
- [Machine Learning on Blockchain Data: A Systematic Mapping Study](https://mlsanity.com/paper/2403.17081/) (2024)
- [Vulnerability and Transaction behavior based detection of Malicious Smart Contracts](https://mlsanity.com/paper/2106.13422/) (2021)
- [Enhanced Smart Contract Reputability Analysis using Multimodal Data Fusion on Ethereum](https://mlsanity.com/paper/2503.17426/) (2025)

## Abstract (arXiv)

The temporal nature of modeling accounts as nodes and transactions as directed edges in a directed graph -- for a blockchain, enables us to understand the behavior (malicious or benign) of the accounts. Predictive classification of accounts as malicious or benign could help users of the permissionless blockchain platforms to operate in a secure manner. Motivated by this, we introduce temporal features such as burst and attractiveness on top of several already used graph properties such as the node degree and clustering coefficient. Using identified features, we train various Machine Learning (ML) algorithms and identify the algorithm that performs the best in detecting which accounts are malicious. We then study the behavior of the accounts over different temporal granularities of the dataset before assigning them malicious tags. For Ethereum blockchain, we identify that for the entire dataset - the ExtraTreesClassifier performs the best among supervised ML algorithms. On the other hand, using cosine similarity on top of the results provided by unsupervised ML algorithms such as K-Means on the entire dataset, we were able to detect 554 more suspicious accounts. Further, using behavior change analysis for accounts, we identify 814 unique suspicious accounts across different temporal granularities.