# Toward Intention Discovery for Early Malice Detection in Bitcoin

arXiv: https://arxiv.org/abs/2209.12001 · HTML: https://mlsanity.com/paper/2209.12001/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 17 of its 43 references that are in the map.
- First posted on arXiv 24 Sep 2022.

## Builds on (most cited first, 17 of 17)

- [On the Properties of Neural Machine Translation: Encoder-Decoder Approaches](https://mlsanity.com/paper/1409.1259/) (2014)
- [CED: Credible Early Detection of Social Media Rumors](https://mlsanity.com/paper/1811.04175/) (2018)
- [A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses](https://mlsanity.com/paper/1908.04507/) (2019)
- [Detecting Mixing Services via Mining Bitcoin Transaction Network with Hybrid Motifs](https://mlsanity.com/paper/2001.05233/) (2020)
- [T-EDGE: Temporal WEighted MultiDiGraph Embedding for Ethereum Transaction Network Analysis](https://mlsanity.com/paper/1905.08038/) (2019)
- [Data mining for detecting Bitcoin Ponzi schemes](https://mlsanity.com/paper/1803.00646/) (2018)
- [BitcoinHeist: Topological Data Analysis for Ransomware Detection on the Bitcoin Blockchain](https://mlsanity.com/paper/1906.07852/) (2019)
- [Ransomware Payments in the Bitcoin Ecosystem](https://mlsanity.com/paper/1804.04080/) (2018)
- [Modeling and Understanding Ethereum Transaction Records via a Complex Network Approach](https://mlsanity.com/paper/2012.15462/) (2020)
- [BlockSci: Design and applications of a blockchain analysis platform](https://mlsanity.com/paper/1709.02489/) (2017)
- [Identifying Illicit Accounts in Large Scale E-payment Networks -- A Graph Representation Learning Approach](https://mlsanity.com/paper/1906.05546/) (2019)
- [ChainNet: Learning on Blockchain Graphs with Topological Features](https://mlsanity.com/paper/1908.06971/) (2019)
- [On the Economic Significance of Ransomware Campaigns: A Bitcoin Transactions Perspective](https://mlsanity.com/paper/1804.01341/) (2018)
- [SAFE: A Neural Survival Analysis Model for Fraud Early Detection](https://mlsanity.com/paper/1809.04683/) (2018)
- [Bitcoin Transaction Graph Analysis](https://mlsanity.com/paper/1502.01657/) (2015)
- [Anomaly Detection in the Bitcoin System - A Network Perspective](https://mlsanity.com/paper/1611.03942/) (2016)
- [Wikipedia Vandal Early Detection: from User Behavior to User Embedding](https://mlsanity.com/paper/1706.00887/) (2017)

## Abstract (arXiv)

Bitcoin has been subject to illicit activities more often than probably any other financial assets, due to the pseudo-anonymous nature of its transacting entities. An ideal detection model is expected to achieve all the three properties of (I) early detection, (II) good interpretability, and (III) versatility for various illicit activities. However, existing solutions cannot meet all these requirements, as most of them heavily rely on deep learning without satisfying interpretability and are only available for retrospective analysis of a specific illicit type. First, we present asset transfer paths, which aim to describe addresses' early characteristics. Next, with a decision tree based strategy for feature selection and segmentation, we split the entire observation period into different segments and encode each as a segment vector. After clustering all these segment vectors, we get the global status vectors, essentially the basic unit to describe the whole intention. Finally, a hierarchical self-attention predictor predicts the label for the given address in real time. A survival module tells the predictor when to stop and proposes the status sequence, namely intention. % With the type-dependent selection strategy and global status vectors, our model can be applied to detect various illicit activities with strong interpretability. The well-designed predictor and particular loss functions strengthen the model's prediction speed and interpretability one step further. Extensive experiments on three real-world datasets show that our proposed algorithm outperforms state-of-the-art methods. Besides, additional case studies justify our model can not only explain existing illicit patterns but can also find new suspicious characters.