Pith. sign in

REVIEW 5 major objections 6 minor 51 references

Fishing for Phishers: Learning-Based Phishing Detection in Ethereum Transactions

T0 review · 5 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper argues that a small set of implicit behavioral and graph features outperforms raw transactional fields for graph-convolutional phishing detection in Ethereum, lifting overall accuracy from 0.79 to 0.95 while per-class phishing…

desk verdict The comparison is unsupported as reported: the split looks transaction-level, and the headline F1 is the weighted average, not phishing-class performance. read the letter →

arxiv 2504.17953 v1 pith:IN6PXYIK submitted 2025-04-24 cs.CR cs.LG

Ahod Alghuried , Abdulaziz Alghamdi , Ali Alkinoon , Soohyeon Choi , Manar Mohaisen , David Mohaisen This is my paper · ORCID
classification cs.CRcs.LG
keywords Ethereumphishingdetectiongraphconvolutionalnetworkimplicitfeaturestransactionanalysisclassimbalancefeatureengineeringblockchainsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Phishing detection on Ethereum usually feeds raw transaction fields—value, gas price, timestamp—into a classifier. This paper tries to establish that a graph convolutional network trained on a small set of implicit behavioral features (how many transactions an address sends or receives, total value moved, average gas, transaction-hour statistics, inter-transaction intervals, weekend-activity ratios) detects phishing addresses far better than the same model trained on raw explicit fields, with accuracy and weighted F1 rising from about 0.79 and 0.70 to 0.95. The authors isolate the two feature classes in separate experiments and show the implicit set wins despite being smaller, supporting the general claim that feature design matters more than feature quantity in adversarial settings. The paper also applies a weighted loss to handle the heavy class imbalance, and it reports per-class phishing precision, recall, and F1 (0.25, 0.33, 0.28) rather than only weighted averages. If the claim holds, it would shift detection practice toward temporal and relational fingerprints that are harder for attackers to fake than surface-level transaction attributes.

What carries the argument

The machinery is a directed transaction graph $G=(V,E)$ whose nodes are Ethereum addresses and whose edges are transactions, combined with a GCN whose propagation rule is $H^{(l+1)} = \sigma(D^{-1/2} A D^{-1/2} H^{(l)} W^{(l)})$, where $A$ is the adjacency matrix, $D$ the degree matrix, and $W^{(l)}$ the learned weights. The node feature matrix is built from the 16 implicit behavioral features, including total value sent and received, average gas for sends and receives, mean and standard deviation of transaction hour, average, minimum, and maximum time between transactions, transaction duration, and weekend-activity ratios. A weighted cross-entropy loss $L = -\sum_i w_{y_i} \log p(y_i)$ counteracts the class imbalance (phishing is about 7.6% of transactions). Random Forest feature-importance ranking and statistical comparisons justify which implicit features are kept. The GCN's neighborhood aggregation lets an address's classification depend on the behavior of the addresses it transacts with.

What would settle it

Count unique Ethereum addresses in the graph and retrain the implicit-feature GCN under a strict address-level 80/20 split. The paper's own data table reports 'phishing nodes' and 'benign nodes' equal to the transaction counts, so the graph may treat transactions as nodes; if a correct address-level split leaves phishing-class recall near 0.33 rather than near the reported F1, the current result is partly label leakage.

Watch

Extended reading notes

Core claim

The paper's central discovery, stated on its own terms, is that implicit graph-derived features are the primary carriers of phishing signal for a GCN on Ethereum's transaction network. In the explicit-feature experiment (value, gas used, gas price, timestamp), the model collapses to essentially always predicting benign, with phishing recall of 0.00 and F1 of 0.01. In the implicit-feature experiment (16 handcrafted temporal and behavioral statistics per address), the same architecture reaches accuracy 0.95 and weighted F1 0.95, with per-class phishing precision 0.25, recall 0.33, and F1 0.28. Feature-importance analysis ranks total value sent, average gas used when sending, and inter-transaction timing as the strongest signals. The paper interprets this as evidence that relational and temporal behavior, not raw transaction values, distinguishes phishers, and that a small focused feature set can outperform a larger set of basic features—an advantage it attributes to adversarial settings where attackers can mimic obvious transaction attributes but not statistical behavioral patterns.

Load-bearing premise

The load-bearing premise is that the 80/20 split separates whole Ethereum addresses, so no address's transactions appear in both training and testing sets; if the split is actually at transaction level, the GCN can silently transfer labels between an address's training and test transactions, inflating the reported performance.

Editorial extensions

If this is right

  • Feature design should be studied separately for each feature class; the paper shows that a 16-feature implicit set outperforms raw explicit fields for a GCN on the same data.
  • Detection systems should favor temporal statistics such as inter-transaction intervals, hour-of-day variability, and weekend ratios over raw value and gas fields when constructing node features.
  • The weighted loss function is a low-cost way to recover minority-class recall without extra hyperparameter tuning, which matters in networks where phishing is under 10% of activity.
  • Graph-based models that propagate labels through address connectivity can surface suspicious addresses that explicit, per-transaction classifiers miss.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the paper leaves implicit is that the same behavioral features could transfer to other automated Ethereum fraud, such as token spamming or Ponzi-style payout patterns, which also produce burst activity and irregular inter-transaction timing.
  • The reported weighted-average F1 of 0.95 is carried almost entirely by the benign majority class; a deployable system would need a cost-sensitive threshold tuned on per-class phishing precision-recall, which the paper itself flags as future work.
  • Because the implicit features are computed from address histories, they could be updated incrementally as new blocks arrive, offering a streaming detection path that avoids re-training the full graph each time.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes a GCN-based phishing detection system for Ethereum transactions, comparing two feature sets: explicit transactional features (value, gas, timestamp) and implicit graph/behavioral features (transaction counts, inter-transaction timing, weekend ratios, etc.). The authors report that implicit features substantially outperform explicit features, with accuracy rising from 0.79 to 0.95 and phishing recall from 0.00 to 0.33, and they further claim an F1-score of 0.95 for their approach. The paper also includes a Random Forest feature-importance analysis, a weighted loss for class imbalance, and a qualitative comparison with prior work.

Significance. If the empirical claims were supported, the paper would make a moderate contribution: a systematic per-feature-type comparison on a large Ethereum dataset, a compact set of temporal/behavioral implicit features, and a weighted-loss treatment of class imbalance. However, the evaluation as presented contains load-bearing inconsistencies: the reported split appears to be at the transaction level rather than the address level, which can leak test information into training; the explicit-feature metrics in Table 5 are arithmetically impossible; and the headline F1 of 0.95 in Table 1 and Section 5.4 is a weighted average that hides the much lower phishing-class scores. The paper does not provide code, full hyperparameters, or exact class weights, so the experiments are not reproducible as described. The central claim that implicit features outperform explicit features is therefore not established by the current evidence.

major comments (5)
  1. [4.1 and Table 3] The reported data split appears to be transaction-level rather than address-level, which leaks test information into training. Section 3.4 defines nodes as Ethereum addresses, and Section 3.1 states the dataset contains 7,915 unique phishing addresses, yet Table 3's 'Phishing Nodes' and 'Benign Nodes' totals (671,865 and 2,687,460) exactly match the phishing and benign transaction counts given in Section 4.1. If the 80/20 split was applied to transactions, the same address appears as a node in both training and test data; because the GCN is transductive and the implicit features in Section 3.3 are aggregated over each address's full transaction history, the reported implicit-feature gains in Section 5.3 can be inflated by label propagation and by features that already contain test-period information. The central comparison between implicit and explicit features is therefore unsupported by the evaluation as described.
  2. [5.2, Table 5] The phishing row of Table 5 reports precision 0.76, recall 0.00, and F1 0.01. With zero true positives, precision is 0 or undefined rather than 0.76, and the F1-score would be 0 rather than 0.01. These internally inconsistent numbers mean the explicit-feature baseline is not reliably characterized, which directly undermines the comparison in Section 5.4 and the claim that implicit features outperform explicit features.
  3. [5.4 and Table 1] Table 1 and Section 5.4 report F1 0.95, precision 0.96, and recall 0.95 for 'Our work,' but the phishing-class results in Table 6 are precision 0.25, recall 0.33, and F1 0.28. The high reported numbers are weighted averages dominated by the benign class. Presenting them as phishing detection performance overstates the method's ability to detect phishing addresses and makes the comparison with prior work in Table 1 misleading, since the prior rows report per-class metrics.
  4. [4.2 and 5.1] The Random Forest feature-importance analysis is described without any mention of a train/test split, and Section 3.3 applies Min-Max scaling using dataset-wide minima and maxima. If feature selection and scaling use the full dataset, then test-period information contributes to the construction of the training features. Combined with the transaction-level split identified above, this is an additional channel through which the reported improvement of implicit features could be inflated.
  5. [5.1, Table 4] The benign-node 'Avg time between tx' value of -5.16×10^4 seconds is impossible for a time interval. This indicates a computation or reporting error in the feature statistics used to justify the proposed feature set, and it reduces confidence in the surrounding statistical analysis.
minor comments (6)
  1. [Abstract] The phrase 'how feature affect model resilience' should read 'how features affect model resilience.'
  2. [3.1] The dataset composition is described as 'around 2M benign and around 600K phishing transactions'; exact counts are given later in Section 4.1, so the approximate language should be replaced with precise numbers throughout.
  3. [References] Reference [20] lists 'Author Name Kimber' as the author, which is a placeholder that should be corrected before submission.
  4. [3.4] The 'Edge Attributes' item says edges carry a phishing/benign label, but the task is node classification; this ambiguity should be clarified, since it is unclear whether the graph edges are labeled separately from node labels.
  5. [4.2] The GCN hyperparameters (number of layers, hidden dimensions, dropout rate, learning rate, epochs) and the exact class weights and decision threshold are not reported. Without these details the experiments are not reproducible.
  6. [3.3] Min-Max scaling should be fitted on the training set only and then applied to the test set; using dataset-wide minima and maxima as described leaks test-set statistics into training.

Circularity Check

2 steps flagged · score 6.0 of 10

Transaction-level split and full-data RF feature selection make the implicit-features 'prediction' partly a re-fit of training labels; the central comparison is not independently supported as reported.

  1. fitted input called prediction [Section 4.1 Data Splitting and Table 3, versus Section 3.4 Graph Construction]
    "Ethereum transaction data was collected using the Etherscan API, comprising 671,865 phishing transactions from 7,915 phishing addresses and 2,687,460 benign transactions. ... The dataset, consisting of phishing and benign addresses, was divided into training and testing using an 80/20 split ... Table 3: Training Set 537,492 ... Testing Set 134,373 ... Total 671,865. ... each node represents an Ethereum address and each edge represents a transaction between two addresses."

    The 'Phishing Nodes' column in Table 3 totals 671,865, exactly the number of phishing transactions, not the 7,915 phishing addresses; the benign column likewise totals 2,687,460, the number of benign transactions. Thus the 80/20 split is over transactions/rows, while the graph model defines nodes as addresses. A single address therefore appears in both training and testing, and the implicit features of Section 3.3 aggregate over the address's full transaction history (including test-period transactions). The GCN's reported test performance is partly a re-fit of labels already seen during training, not a prediction on unseen phishing addresses. The headline claim that selected implicit features outperform explicit features is not supported as an independent evaluation.

  2. fitted input called prediction [Section 3.3 Feature Analysis and Selection; Section 5.1 Distinguishing Features; Section 5.4 Comparative Evaluation]
    "The RF classifier was then applied to rank the importance of the extracted features. This dual approach ensures a comprehensive understanding of feature relevance, enhancing the model's accuracy by focusing on the most predictive attributes. ... RF classifier was applied to accurately quantify the most important features for distinguishing phishing from benign nodes. ... Importantly, we combined this with statistical validation and feature importance ranking using Random Forests to systematically identify and prioritize the most predictive attributes."

    The RF importance ranking is presented as the basis for the 'refined implicit features' used by the GCN, but the paper does not restrict the RF analysis to the training split; it is described in the Results as quantifying features 'distinguishing phishing from benign nodes' on the dataset as a whole. Because the same full dataset is then used to report the GCN's implicit-feature performance, the feature choice is fitted to the test labels. The conclusion that a small set of carefully selected features outperforms larger explicit sets therefore partially re-states the feature-selection signal instead of independently predicting it.

full rationale

The paper is an empirical comparison, not a derivation, so there is no equation-level equivalence between inputs and outputs. However, two reported design choices undermine the independence of the central 'implicit features outperform explicit features' claim. First, Table 3's node counts exactly equal transaction counts, while Section 3.4 defines nodes as addresses; this makes the 80/20 split transaction-level. With graph edges being transactions, the same address can appear in both training and testing, and the aggregate implicit features and GCN message passing let training labels leak into the reported test numbers. Second, the Random Forest feature-importance analysis is presented as the basis for the 'refined implicit features' used by the GCN, with no statement that it was restricted to the training split; if it used the full dataset, the feature selection was fit to the same labels later used for evaluation. Together these make several reported 'predictions' partly re-statements of the fitting input. Separate correctness issues, such as the impossible explicit-feature phishing precision of 0.76 with recall 0.00 in Table 5, are noted but are not circularity. No load-bearing self-citation was found; the phishing-address list is from an external GitHub dataset, and comparisons are against external baselines.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The paper introduces no new entities. Its central claim rests on the reliability of the phishing address list, the Etherscan API, the benign address assumption, the mapping from transaction labels to node labels, and standard GCN mathematics. The main free parameters are the class weight, the decision threshold, and unreported GCN hyperparameters.

free parameters (3)
  • Phishing class weight in weighted loss = not reported
    Equation 1 introduces class weight w_yi for the underrepresented class; the specific weight value is not given, and the choice affects recall and precision.
  • Classification threshold = not reported
    Section 3.5 states addresses above a fixed threshold are classified as phishing, but the threshold value is never specified.
  • GCN hyperparameters = not reported
    Number of layers, hidden dimensions, learning rate, epochs, dropout rate, and optimizer are not stated in Sections 3.4 or 4.2, so the reported performance depends on unlisted choices.
assumptions (6)
  • domain assumption The public GitHub phishing address list is accurate and complete enough to label transactions.
    Section 3.1 uses this list as the source of ground truth; if it is incomplete or noisy, all labels and metrics inherit the error.
  • domain assumption Etherscan API transaction records are complete and correctly parsed.
    All data collection in Section 3.1 relies on the Etherscan API; missing or malformed records would bias both classes.
  • domain assumption Benign addresses selected from historical records have no undisclosed phishing involvement.
    Section 3.1 labels transactions as benign when neither address appears in the phishing list; false negatives in the ground truth would dilute both training and evaluation.
  • domain assumption A transaction is phishing whenever a party is a known phishing address, and node labels are derived consistently from transaction labels.
    The 1-hop labeling rule in Figure 3 and Section 3.1 defines phishing this way and does not document how transaction labels are mapped to address-node labels.
  • domain assumption GCN message passing is an appropriate model for Ethereum transaction networks.
    Section 3.4 chooses GCN over other architectures without comparison; the adjacency structure is treated as informative for phishing.
  • standard math Standard matrix operations and the GCN propagation rule (Equation 2) are valid.
    The propagation rule uses the symmetric normalized adjacency matrix; this is standard and requires no proof here.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fishing for Phishers: Learning-Based Phishing Detection in Ethereum Transactions." pith.science (2026). https://pith.science/paper/IN6PXYIK

@misc{pith2026250417953,
  author       = {Pith},
  title        = {Pith review of: Fishing for Phishers: Learning-Based Phishing Detection in Ethereum Transactions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IN6PXYIK}},
  note         = {Machine review of arXiv:2504.17953}
}
read the original abstract

Phishing detection on Ethereum has increasingly leveraged advanced machine learning techniques to identify fraudulent transactions. However, limited attention has been given to understanding the effectiveness of feature selection strategies and the role of graph-based models in enhancing detection accuracy. In this paper, we systematically examine these issues by analyzing and contrasting explicit transactional features and implicit graph-based features, both experimentally and analytically. We explore how different feature sets impact the performance of phishing detection models, particularly in the context of Ethereum's transactional network. Additionally, we address key challenges such as class imbalance and dataset composition and their influence on the robustness and precision of detection methods. Our findings demonstrate the advantages and limitations of each feature type, while also providing a clearer understanding of how feature affect model resilience and generalization in adversarial environments.

Figures

Figures reproduced from arXiv: 2504.17953 by the authors.

Figure 1
Figure 1. Illustration of the Ethereum phishing scam network. Phishing addresses (red nodes) are interspersed [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. An illustration of the proposed pipeline, integrating explicit and implicit features from the Ethereum [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Construction of a directed Ethereum transaction graph and its transformation into PyTorch Geometric [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Top 10 important features based on Random Forest. [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 42 canonical work pages

  1. [1]

    Ayodeji Adeniran, Kieran Human, and David Mohaisen. 2024. Dissecting the Infrastructure Used in Web-based Cryptojacking: A Measurement Perspective. CoRR abs/2408.03426 (2024). https://doi.org/10.48550/ARXIV.2408.03426

    work page Pith review arXiv doi:10.48550/arxiv.2408.03426 2024

  2. [2]

    Bassiouni, and Aziz Mohaisen

    Ashar Ahmad, Muhammad Saad, Mostafa A. Bassiouni, and Aziz Mohaisen. 2018. Towards Blockchain-Driven, Secure and Transparent Audit Logs. In Proceedings of the 15th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, MobiQuitous 2018, 5-7 November 2018, New York City, NY, USA . ACM, 443–448. https://doi.org/10...

    work page arXiv 2018

  3. [3]

    Ahod Alghuried and David Mohaisen. 2024. Simple Perturbations Subvert Ethereum Phishing Transactions Detection: An Empirical Analysis. In The 25th International Conference Information Security Applications, WISA . 1–12

    work page 2024

  4. [4]

    Massimo Bartoletti, Stefano Lande, Andrea Loddo, Livio Pompianu, and Sergio Serusi. 2021. Cryptocurrency Scams: Analysis and Perspectives. IEEE Access 9 (2021), 148353–148373. https://doi.org/10.1109/ACCESS.2021.3123894

    arXiv 2021

  5. [5]

    Shaista Bibi. 2019. Cryptocurrency world identification and public concerns detection via social media: student research abstract. In Proceedings of the 34th ACM/SIGAPP Symposium on Applied Computing, SAC . ACM, 550–552

    work page 2019

  6. [6]

    Federico Cernera, Massimo La Morgia, Alessandro Mei, and Francesco Sassi. 2023. Token Spammers, Rug Pulls, and Sniper Bots: An Analysis of the Ecosystem of Tokens in Ethereum and in the Binance Smart Chain (BNB). In 32nd USENIX Security Symposium. USENIX Association, 3349–3366

    work page 2023

  7. [7]

    Huashan Chen, Marcus Pendleton, Laurent Njilla, and Shouhuai Xu. 2021. A Survey on Ethereum Systems Security: Vulnerabilities, Attacks, and Defenses. ACM Comput. Surv. 53, 3 (2021), 67:1–67:43

    work page 2021

  8. [8]

    Liang Chen, Jiaying Peng, Yang Liu, Jintang Li, Fenfang Xie, and Zibin Zheng. 2021. Phishing Scams Detection in Ethereum Transaction Network. ACM Trans. Internet Techn. 21, 1 (2021), 10:1–10:16

    work page 2021

Show all 51 references
  1. [9]

    Weili Chen, Xiongfeng Guo, Zhiguang Chen, Zibin Zheng, and Yutong Lu. 2020. Phishing Scam Detection on Ethereum: Towards Financial Security for Blockchain Ecosystem. InProceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence, IJCAI. ijcai.org, ...

    2020

  2. [10]

    Ling Cheng, Feida Zhu, Yong Wang, Ruicheng Liang, and Huiwen Liu. 2023. Evolve Path Tracer: Early Detection of Malicious Addresses in Cryptocurrency. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD . ACM, 3889–3900

    2023

  3. [11]

    Ling Cheng, Feida Zhu, Yong Wang, Ruicheng Liang, and Huiwen Liu. 2024. From Asset Flow to Status, Action, and Intention Discovery: Early Malice Detection in Cryptocurrency. ACM Trans. Knowl. Discov. Data 18, 3 (2024), 50:1–50:27

    2024

  4. [12]

    Bingxue Fu, Xing Yu, and Tao Feng. 2022. CT-GCN: a phishing identification model for blockchain cryptocurrency transactions. Int. J. Inf. Sec. 21, 6 (2022), 1223–1232

    2022

  5. [13]

    Letterio Galletta and Fabio Pinelli. 2024. Explainable Ponzi Schemes Detection on Ethereum. In Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing, SAC , Jiman Hong and Juw Won Park (Eds.). ACM, 1014–1023

    2024

  6. [14]

    Bowen He, Yuan Chen, Zhuo Chen, Xiaohui Hu, Yufeng Hu, Lei Wu, Rui Chang, Haoyu Wang, and Yajin Zhou. 2023. TxPhishScope: Towards Detecting and Understanding Transaction-based Phishing on Ethereum. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications...

    2023

  7. [15]

    Hwanjo Heo, Seungwon Woo, Taeung Yoon, Min Suk Kang, and Seungwon Shin. 2023. Partitioning Ethereum without Eclipsing It. In 30th Annual Network and Distributed System Security Symposium, NDSS . The Internet Society

    2023

  8. [16]

    Lars Hornuf, Paul P Momtaz, Rachel J Nam, and Ye Yuan. 2023. Cybercrime on the ethereum blockchain. (2023)

    2023

  9. [17]

    Jones, Miriam E

    Keith S. Jones, Miriam E. Armstrong, McKenna K. Tornblad, and Akbar Siami Namin. 2021. How social engineers use persuasion principles during vishing attacks. Inf. Comput. Secur. 29, 2 (2021), 314–331. https://doi.org/10.1108/ICS-07- 2020-0113

    2021 doi

  10. [18]

    Arkan Hammoodi Hasan Kabla, Mohammed Anbar, Selvakumar Manickam, and Shankar Karuppayah. 2022. Eth-PSD: A Machine Learning-Based Phishing Scam Detection Approach in Ethereum. IEEE Access 10 (2022), 118043–118057. , Vol. 1, No. 1, Article . Publication date: April 2025. 22 Ahod...

    2022

  11. [19]

    Olaf Kampers, Abdulhakim Ali Qahtan, Swati Mathur, and Yannis Velegrakis. 2022. Manipulation detection in cryptocurrency markets: an anomaly and change detection based approach. In SAC ’22: The 37th ACM/SIGAPP Symposium on Applied Computing. ACM, 326–329

    2022

  12. [20]

    Author Name Kimber. 2023. Scams on Ethereum. (2023). https://github.com/YNclusk/scamsonethereum

    2023

  13. [21]

    Sijia Li, Gaopeng Gou, Chang Liu, Chengshang Hou, Zhenzhen Li, and Gang Xiong. 2022. TTAGN: Temporal Transaction Aggregation Graph Network for Ethereum Phishing Scams Detection. In WWW ’22: The ACM Web Conference 2022. ACM, 661–669

    2022

  14. [22]

    Sijia Li, Gaopeng Gou, Chang Liu, Gang Xiong, Zhen Li, Junchao Xiao, and Xinyu Xing. 2023. TGC: Transaction Graph Contrast Network for Ethereum Phishing Scam Detection. In Annual Computer Security Applications Conference, ACSAC. ACM, 352–365

    2023

  15. [23]

    Shucheng Li, Runchuan Wang, Hao Wu, Sheng Zhong, and Fengyuan Xu. 2023. SIEGE: Self-Supervised Incremental Deep Graph Learning for Ethereum Phishing Scam Detection. In Proceedings of the 31st ACM International Conference on Multimedia, MM. ACM, 8881–8890

    2023

  16. [24]

    Zhutian Lin, Xi Xiao, Guangwu Hu, Bin Zhang, Qixu Liu, and Xiapu Luo. 2023. Phish2vec: A Temporal and Heteroge- neous Network Embedding Approach for Detecting Phishing Scams on Ethereum. In 20th Annual IEEE International Conference on Sensing, Communication, and Networking, SE...

    2023

  17. [25]

    Jieli Liu, Jinze Chen, Jiajing Wu, Zhiying Wu, Junyuan Fang, and Zibin Zheng. 2024. Fishing for Fraudsters: Uncovering Ethereum Phishing Gangs With Blockchain Data. IEEE Trans. Inf. Forensics Secur. 19 (2024), 3038–3050

    2024

  18. [26]

    NetworkX. 2024. NetworkX. https://networkx.org/. (2024). Accessed: 2024-11

    2024

  19. [27]

    Cuong Phuc Ngo, Amadeus Aristo Winarto, Connie Khor Li Kou, Sojeong Park, Farhan Akram, and Hwee Kuan Lee

  20. [28]

    Pawel Pinio, Roman Batko, and Dagmara Lewicka. 2024. Between Theory and Value Transactions: A Multifaceted Exploration of Relevance and Resilience of Decentralised Autonomous Organisations. In Proceedings of the 2024 7th International Conference on Software Engineering and Inf...

    2024

  21. [29]

    Muhammad Saad, Ashar Ahmad, and Aziz Mohaisen. 2019. Fighting Fake News Propagation with Blockchains. In 7th IEEE Conference on Communications and Network Security, CNS 2019, Washington, DC, USA, June 10-12, 2019 . IEEE, 1–4. https://doi.org/10.1109/CNS.2019.8802670

    2019

  22. [30]

    2022.RouteChain: Towards Blockchain-based secure and efficient BGP routing

    Muhammad Saad, Afsah Anwar, Ashar Ahmad, Hisham Alasmary, Murat Yuksel, and David Mohaisen. 2022.RouteChain: Towards Blockchain-based secure and efficient BGP routing. Comput. Networks 217 (2022), 109362. https://doi.org/10. 1016/J.COMNET.2022.109362

    2022

  23. [31]

    Muhammad Saad, Songqing Chen, and David Mohaisen. 2021. SyncAttack: Double-spending in Bitcoin Without Mining Power. In CCS ’21: 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, Republic of Korea, November 15 - 19, 2021 . ACM, 1668–1685. https...

    2021

  24. [32]

    Muhammad Saad, Jinchun Choi, DaeHun Nyang, Joongheon Kim, and Aziz Mohaisen. 2020. Toward Characterizing Blockchain-Based Cryptocurrencies for Highly Accurate Predictions. IEEE Syst. J. 14, 1 (2020), 321–332. https: //doi.org/10.1109/JSYST.2019.2927707

    2020

  25. [33]

    Muhammad Saad, Joongheon Kim, DaeHun Nyang, and David Mohaisen. 2021. Contra-∗: Mechanisms for countering spam attacks on blockchain’s memory pools. J. Netw. Comput. Appl. 179 (2021), 102971. https://doi.org/10.1016/J.JNCA. 2020.102971

    2021

  26. [34]

    Muhammad Saad and David Mohaisen. 2023. Three Birds with One Stone: Efficient Partitioning Attacks on Interde- pendent Cryptocurrency Networks. In 44th IEEE Symposium on Security and Privacy, SP . IEEE, 111–125

    2023

  27. [35]

    Kamhoua, Joongheon Kim, DaeHun Nyang, and Aziz Mohaisen

    Muhammad Saad, Laurent Njilla, Charles A. Kamhoua, Joongheon Kim, DaeHun Nyang, and Aziz Mohaisen. 2019. Mempool optimization for Defending Against DDoS Attacks in PoW-based Blockchain Systems. In IEEE International Conference on Blockchain and Cryptocurrency, ICBC 2019, Seoul...

    2019

  28. [36]

    Kamhoua, and Aziz Mohaisen

    Muhammad Saad, Laurent Njilla, Charles A. Kamhoua, and Aziz Mohaisen. 2019. Countering Selfish Mining in Blockchains. In International Conference on Computing, Networking and Communications, ICNC 2019, Honolulu, HI, USA, February 18-21, 2019 . IEEE, 360–364. https://doi.org/10...

    2019

  29. [37]

    Kamhoua, Sachin Shetty, DaeHun Nyang, and David Mohaisen

    Muhammad Saad, Jeffrey Spaulding, Laurent Njilla, Charles A. Kamhoua, Sachin Shetty, DaeHun Nyang, and David Mohaisen. 2020. Exploring the Attack Surface of Blockchain: A Comprehensive Survey. IEEE Commun. Surv. Tutorials 22, 3 (2020), 1977–2008

    2020

  30. [38]

    Marie Vasek and Tyler Moore. 2015. There’s No Free Lunch, Even Using Bitcoin: Tracking the Popularity and Profits of Virtual Currency Scams. In Financial Cryptography and Data Security - 19th International Conference, FC (Lecture Notes in Computer Science) , Vol. 8975. Springer, 44–61

    2015

  31. [39]

    Yun Wan, Feng Xiao, and Dapeng Zhang. 2023. Early-stage phishing detection on the Ethereum transaction network. Soft Comput. 27, 7 (2023), 3707–3719. https://doi.org/10.1007/S00500-022-07661-0 , Vol. 1, No. 1, Article . Publication date: April 2025. Fishing for Phishers: Learn...

    2023 doi

  32. [40]

    Jinhuan Wang, Pengtao Chen, Xinyao Xu, Jiajing Wu, Meng Shen, Qi Xuan, and Xiaoniu Yang. 2022. TSGN: Transaction Subgraph Networks Assisting Phishing Detection in Ethereum. CoRR abs/2208.12938 (2022)

    2022 arXiv

  33. [41]

    Kai Wang, Michael Tong, Jun Pang, Jitao Wang, and Weili Han. 2024. XRAD: Ransomware Address Detection Method based on Bitcoin Transaction Relationships. ACM Trans. Web (2024)

    2024

  34. [42]

    Tingke Wen, Yuanxing Xiao, Anqi Wang, and Haizhou Wang. 2023. A novel hybrid feature fusion model for detecting phishing scam on Ethereum using deep neural network. Expert Syst. Appl. 211 (2023), 118463

    2023

  35. [43]

    Jiajing Wu, Qi Yuan, Dan Lin, Wei You, Weili Chen, Chuan Chen, and Zibin Zheng. 2022. Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding. IEEE Trans. Syst. Man Cybern. Syst. 52, 2 (2022), 1156–1166

    2022

  36. [44]

    Yijun Xia, Jieli Liu, and Jiajing Wu. 2022. Phishing Detection on Ethereum via Attributed Ego-Graph Embedding. IEEE Trans. Circuits Syst. II Express Briefs 69, 5 (2022), 2538–2542

    2022

  37. [45]

    Yufeng Xu, Lun Zhang, Turan Vural, Peng Qian, Yanbin Wang, Yuqing Fan, Ming Li, Xueyan Tang, and Zheng Cao

  38. [46]

    Mingxuan Yao, Runze Zhang, Haichuan Xu, Shih-Huan Chou, Varun Chowdhary Paturi, Amit Kumar Sikder, and Brendan Saltaformaggio. 2024. Pulling Off The Mask: Forensic Analysis of the Deceptive Creator Wallets Behind Smart Contract Fraud. In IEEE Symposium on Security and Privacy,...

    2024

  39. [47]

    Parizi, Mohammad Hammoudeh, Hadis Karimipour, and Gautam Srivastava

    Abbas Yazdinejad, Ali Dehghantanha, Reza M. Parizi, Mohammad Hammoudeh, Hadis Karimipour, and Gautam Srivastava. 2022. Block Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-Based IIoT Networks. IEEE Trans. Ind. Informatics 18, 11 (2022), 8356–8366

    2022

  40. [48]

    Qi Yuan, Baoying Huang, Jie Zhang, Jiajing Wu, Haonan Zhang, and Xi Zhang. 2020. Detecting Phishing Scams on Ethereum Based on Transaction Records. In IEEE International Symposium on Circuits and Systems, ISCAS . IEEE, 1–5

    2020

  41. [49]

    Xuanchen Zhou, Wenzhong Yang, and Xiaodan Tian. 2023. Detecting Phishing Accounts on Ethereum Based on Transaction Records and EGAT. Electronics 12, 4 (2023). , Vol. 1, No. 1, Article . Publication date: April 2025

    2023

  42. [2019]

    In 31st IEEE International Conference on Tools with Artificial Intelligence, ICTAI

    Fence GAN: Towards Better Anomaly Detection. In 31st IEEE International Conference on Tools with Artificial Intelligence, ICTAI. IEEE, 141–148

  43. [2023]

    In Proceedings of the 2023 7th International Conference on Electronic Information Technology and Computer Engineering, EITCE

    STFN: Spatio-Temporal Fusion Network to Detect Ethereum Phishing Scams. In Proceedings of the 2023 7th International Conference on Electronic Information Technology and Computer Engineering, EITCE . ACM, 599–605

    2023

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.