# TEGDetector: A Phishing Detector that Knows Evolving Transaction Behaviors

arXiv: https://arxiv.org/abs/2111.15446 · HTML: https://mlsanity.com/paper/2111.15446/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 24 of its 56 references that are in the map.
- First posted on arXiv 26 Nov 2021.

## Builds on (most cited first, 24 of 24)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation](https://mlsanity.com/paper/1406.1078/) (2014)
- [Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling](https://mlsanity.com/paper/1412.3555/) (2014)
- [Convolutional Neural Networks on Graphs with Fast Localized Spectral Filtering](https://mlsanity.com/paper/1606.09375/) (2016)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [DeepWalk: Online Learning of Social Representations](https://mlsanity.com/paper/1403.6652/) (2014)
- [Hierarchical Graph Representation Learning with Differentiable Pooling](https://mlsanity.com/paper/1806.08804/) (2018)
- [Self-Attention Graph Pooling](https://mlsanity.com/paper/1904.08082/) (2019)
- [Adversarial Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/1805.07984/) (2018)
- [Adversarial Attack on Graph Structured Data](https://mlsanity.com/paper/1806.02371/) (2018)
- [Graph Embedding Techniques, Applications, and Performance: A Survey](https://mlsanity.com/paper/1705.02801/) (2017)
- [A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Models](https://mlsanity.com/paper/1908.01297/) (2019)
- [Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding](https://mlsanity.com/paper/1911.09259/) (2019)
- [E-LSTM-D: A Deep Learning Framework for Dynamic Network Link Prediction](https://mlsanity.com/paper/1902.08329/) (2019)
- [T-EDGE: Temporal WEighted MultiDiGraph Embedding for Ethereum Transaction Network Analysis](https://mlsanity.com/paper/1905.08038/) (2019)
- [K-Core based Temporal Graph Convolutional Network for Dynamic Graphs](https://mlsanity.com/paper/2003.09902/) (2020)
- [Identity Inference on Blockchain using Graph Neural Network](https://mlsanity.com/paper/2104.06559/) (2021)
- [An Evaluation of Bitcoin Address Classification based on Transaction History Summarization](https://mlsanity.com/paper/1903.07994/) (2019)
- [TSGN: Transaction Subgraph Networks for Identifying Ethereum Phishing Accounts](https://mlsanity.com/paper/2104.08767/) (2021)
- [RAIDER: Reinforcement-aided Spear Phishing Detector](https://mlsanity.com/paper/2105.07582/) (2021)
- [Blockchain Phishing Scam Detection via Multi-channel Graph Classification](https://mlsanity.com/paper/2108.08456/) (2021)
- [A Lightweight and Scalable Physical Layer Attack Detection Mechanism for the Internet of Things (IoT) Using Hybrid Security Schema](https://mlsanity.com/paper/2103.16920/) (2021)
- [SoS-RPL: Securing Internet of Things Against Sinkhole Attack Using RPL Protocol-Based Node Rating and Ranking Mechanism](https://mlsanity.com/paper/2005.09140/) (2020)

## Abstract (arXiv)

Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses' transaction behavior features by random walking or constructing static subgraphs. The random walking methods,unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address's transaction behaviors in different periods. Then, we provide a fast non-parametric phishing detector to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions towards a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learnt time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art detection performance.