An Abnormal Account Identification Method by Topology Feature Analysis for Blockchain-Based Transaction Network

Round 1

Reviewer 1 Report

I noticed that they do not include recent publications from 2023. To improve the manuscript, it's essential to incorporate more recent references, especially if there have been significant advancements or changes in the field since the publication of the cited works. This would ensure that the study is built upon the most current understanding and research findings.

Author Response

1 Reviewer #1

I noticed that they do not include recent publications from 2023. To improve the manuscript, it's essential to incorporate more recent references, especially if there have been significant advancements or changes in the field since the publication of the cited works. This would ensure that the study is built upon the most current understanding and research findings.

Response: Thanks for the comments! In this work, we propose a method for identifying abnormal accounts using topology analysis of cryptographic transactions. We consider the accounts and transactions in the blockchain as graph nodes and edges. Since the abnormal accounts may have special topology features, then we extract topology features from the transaction graph. By analyzing the topology features of transactions, we discover that the high-dimensional sparse topology features can be compressed by using the singular value decomposition method for feature dimension reduction. Subsequently, we use the adversarial generative network to generate samples like abnormal accounts, which will be sent to the training data set to make equilibrium abnormal/normal accounts. Finally, we utilize several machine learning techniques to detect abnormal accounts in the blockchain.Our experimental results demonstrate that our method significantly improves the accuracy and recall rate for detecting abnormal accounts in blockchain compared with the state-of-the-art methods.

We fully agree with you that ensuring that the references for your dissertation are up-to-date is critical to enhancing the scholarly value and currency of your dissertation. We conduct a comprehensive search and review of relevant literature for the year 2023、2024, especially those that have made significant advances or changes in the field. We add these recent findings to our literature review section to build on current understanding and research findings. Such as:

Mohy et.al built the NIDS using the KNN algorithm to improve the IDS accuracy (ACC) and detection rate (DR). Furthermore, the principal component analysis (PCA), univariate statistical test, and genetic algorithm (GA) are used for feature selection separately to improve the data quality and select the ten best performing features.

Cryptocurrency abnormal transaction detection method with spatio-temporal and global representation, the CTDM combines EvolveGCN with MGU and global representations to achieve better performance(Xiao et.al). Conduct an extensive survey of the blockchain anomaly transaction detection and apply graph convolutional networks to the domain of blockchain anomaly detection(Liu et.al).

Using a Semi-Supervised Generative Adversarial Network, which efficiently detects abnormal attacks within the Ethereum network(Sanjalawe et.al ). The system integrates blockchain at Base Stations and Cluster Heads in a Wireless Sensor Network to enhance security, using a Machine Learning classifier called Histogram Gradient Boost to identify and revoke malicious nodes(Muhammad et.al).

The system architecture for detecting fraudulent transactions and attacks in the BC network is based on Machine Learning. Using Machine Learning to check medical data from sensors and block abnormal data from entering the blockchain network(Mohammed et.al). Utilizing data structures known as sketches, specifically bloom filters and hyperLogLog, to identify suspicious accounts without requiring the examination of the entire blockchain data, develop methods to identify accounts with high transaction volume, frequency, and node degree(Voronov et.al ). Highlight how an interplay between blockchain and ML would allow both technologies to assist 130 cybersecurity-related use cases(Venkatesan et.al).

Finally, We add Table 1 summarizes and compares the main issues addressed in the existing literature.

Reviewer 2 Report

The authors proposed a paper titled “An Abnormal Account Identification Method by Topology Feature Analysis for Blockchain-based Transaction Network”, which revolves around the detection of  abnormal accounts by training with imbalanced abnormal/normal accounts. The research topic is very important. The paper is well-written, and the proposed method is clearly described. The authors provide sufficient details on the experimental setup and the evaluation results, which demonstrate the effectiveness of the proposed method. the following minor modifications are suggested to improve the quality of the paper.

 - Authors should add more related works and summarize the literature review in some form of comparison table to draw conclusions.

- The authors are requested to elaborate more on how they verify that the samples generated by the adversarial generative network are like the abnormal accounts.

- List the limitations of your study in the conclusion section.

Author Response

2 Reviewer #2

The authors proposed a paper titled “An Abnormal Account Identification Method by Topology Feature Analysis for Blockchain-based Transaction Network”, which revolves around the detection of  abnormal accounts by training with imbalanced abnormal/normal accounts. The research topic is very important. The paper is well-written, and the proposed method is clearly described. The authors provide sufficient details on the experimental setup and the evaluation results, which demonstrate the effectiveness of the proposed method. the following minor modifications are suggested to improve the quality of the paper.

Response: Thanks for the comments! In this work, we propose a method for identifying abnormal accounts using topology analysis of cryptographic transactions. We consider the accounts and transactions in the blockchain as graph nodes and edges. Since the abnormal accounts may have special topology features, then we extract topology features from the transaction graph. By analyzing the topology features of transactions, we discover that the high-dimensional sparse topology features can be compressed by using the singular value decomposition method for feature dimension reduction. Subsequently, we use the adversarial generative network to generate samples like abnormal accounts, which will be sent to the training data set to make equilibrium abnormal/normal accounts. Finally, we utilize several machine learning techniques to detect abnormal accounts in the blockchain.Our experimental results demonstrate that our method significantly improves the accuracy and recall rate for detecting abnormal accounts in blockchain compared with the state-of-the-art methods.

Q1: Authors should add more related works and summarize the literature review in some form of comparison table to draw conclusions.

Response: Many thanks for the constructive suggestions! According to your suggestion, Thanks for the comments! We conduct a comprehensive search and review of relevant literature for the year 2023、2024, especially those that have made significant advances or changes in the field. We add these recent findings to our literature review section to build on current understanding and research findings. Such as:

Mohy et.al built the NIDS using the KNN algorithm to improve the IDS accuracy (ACC) and detection rate (DR). Furthermore, the principal component analysis (PCA), univariate statistical test, and genetic algorithm (GA) are used for feature selection separately to improve the data quality and select the ten best performing features.

Cryptocurrency abnormal transaction detection method with spatio-temporal and global representation, the CTDM combines EvolveGCN with MGU and global representations to achieve better performance(Xiao et.al). Conduct an extensive survey of the blockchain anomaly transaction detection and apply graph convolutional networks to the domain of blockchain anomaly detection(Liu et.al).

Using a Semi-Supervised Generative Adversarial Network, which efficiently detects abnormal attacks within the Ethereum network(Sanjalawe et.al ). The system integrates blockchain at Base Stations and Cluster Heads in a Wireless Sensor Network to enhance security, using a Machine Learning classifier called Histogram Gradient Boost to identify and revoke malicious nodes(Muhammad et.al).

The system architecture for detecting fraudulent transactions and attacks in the BC network is based on Machine Learning. Using Machine Learning to check medical data from sensors and block abnormal data from entering the blockchain network(Mohammed et.al). Utilizing data structures known as sketches, specifically bloom filters and hyperLogLog, to identify suspicious accounts without requiring the examination of the entire blockchain data, develop methods to identify accounts with high transaction volume, frequency, and node degree(Voronov et.al ). Highlight how an interplay between blockchain and ML would allow both technologies to assist 130 cybersecurity-related use cases(Venkatesan et.al).

Finally, We add Table 1 summarizes and compares the main issues addressed in the existing literature.

Q2: The authors are requested to elaborate more on how they verify that the samples generated by the adversarial generative network are like the abnormal accounts.

Response: Many thanks for the constructive suggestions! According to your suggestion, we have added the part to verify that the samples generated by the adversarial generative network are like the abnormal accounts. 

To validate the similarity of the generated topology by the GAN network to abnormal accounts, the GAN has reached a level of convergence where the topology feature generator’s adversarial loss is decreasing and the topology feature discriminator’s adversarial loss is stabilizing. This suggests that the generator is producing increasingly realistic topology features, and the discriminator is improving at distinguishing between real and generated features. And then evaluate the discriminator’s performance by feeding it a mix of real abnormal account topology features and the generated ones. If the discriminator struggles to differentiate between the two, it indicates that the generated features closely resemble the real ones.

Q3: List the limitations of your study in the conclusion section.

Response: Many thanks for the constructive suggestions! According to your suggestion, The limitations of this study have been carefully considered and are detailed in the conclusions section as follows: 

However, the development of blockchain technology is rapidly changing, and there is still vast room for research on abnormal account identification in blockchain. The limitations of this study are discussed below:

Long-term effectiveness and iterative model updating.

Although the method proposed in this paper has achieved some results in dealing with small samples and high-dimensional sparse features, there are still some limitations. In real-world environments, the model may face different challenges than in experimental environments, including new attack methods, more complex transaction patterns, and changing blockchain network structures. Therefore, it is crucial to track and evaluate the performance of the model in the long term, and long-term performance monitoring and data collection can be performed in future research by deploying the model into a real-running blockchain system to verify the lasting effectiveness of the model.

Introducing more types of transaction data.

This paper mainly focuses on user transaction mapping features, but in practical applications, there may be other types of transaction data, such as smart contract execution data, transaction amounts, etc. Future research can try to incorporate more types of transaction data into the analysis framework to enrich the feature dimensions and improve the performance of abnormal account identification.

Reviewer 3 Report

The topic of this work is interesting. Some suggestions for further improvement of the paper is mentioned below:

In the related work section, not sure if a separate subsection is required for literature review. Also, the literature review part (subsection 2.1) is quite brief. It would be good to include some more related works.

Section 2 mentions that in recent years, there has been an increasing amount of research focused on detecting abnormal blockchain accounts. It would be beneficial to cite these studies and include a discussion on them.

Section 2.2 needs to clearly highlight the current research gap and analyse how this work is different from existing literature. While some discussion has been included, it requires clearer emphasis.

Section 3 heading “Material and methods” is a bit confusing. Please consider changing the heading.

There are quite a few cases of editing issues such as:

·         spacing issue (space missing after “.” Or “,”) throughout the paper.

·         Capitalisation within a sentence (line 98, 102 etc)

·         typographical mistakes.

Please proofread it before submission.

It would be good if the font size of the text of Figure 1 could be increased.

NA

Author Response

3 Reviewer #3

The topic of this work is interesting. Some suggestions for further improvement of the paper is mentioned below:

Response: Many thanks for the constructive suggestions! In this work, we propose a method for identifying abnormal accounts using topology analysis of cryptographic transactions. We consider the accounts and transactions in the blockchain as graph nodes and edges. Since the abnormal accounts may have special topology features, then we extract topology features from the transaction graph. By analyzing the topology features of transactions, we discover that the high-dimensional sparse topology features can be compressed by using the singular value decomposition method for feature dimension reduction. Subsequently, we use the adversarial generative network to generate samples like abnormal accounts, which will be sent to the training data set to make equilibrium abnormal/normal accounts. Finally, we utilize several machine learning techniques to detect abnormal accounts in the blockchain.Our experimental results demonstrate that our method significantly improves the accuracy and recall rate for detecting abnormal accounts in blockchain compared with the state-of-the-art methods.

Q1: In the related work section, not sure if a separate subsection is required for literature review. Also, the literature review part (subsection 2.1) is quite brief. It would be good to include some more related works.Section 2 mentions that in recent years, there has been an increasing amount of research focused on detecting abnormal blockchain accounts. It would be beneficial to cite these studies and include a discussion on them.

Response: Many thanks for the constructive suggestions! We conduct a comprehensive search and review of relevant literature for the year 2023、2024, especially those that have made significant advances or changes in the field. We add these recent findings to our literature review section to build on current understanding and research findings. Such as:

Mohy et.al built the NIDS using the KNN algorithm to improve the IDS accuracy (ACC) and detection rate (DR). Furthermore, the principal component analysis (PCA), univariate statistical test, and genetic algorithm (GA) are used for feature selection separately to improve the data quality and select the ten best performing features.

Cryptocurrency abnormal transaction detection method with spatio-temporal and global representation, the CTDM combines EvolveGCN with MGU and global representations to achieve better performance(Xiao et.al). Conduct an extensive survey of the blockchain anomaly transaction detection and apply graph convolutional networks to the domain of blockchain anomaly detection(Liu et.al).

Using a Semi-Supervised Generative Adversarial Network, which efficiently detects abnormal attacks within the Ethereum network(Sanjalawe et.al ). The system integrates blockchain at Base Stations and Cluster Heads in a Wireless Sensor Network to enhance security, using a Machine Learning classifier called Histogram Gradient Boost to identify and revoke malicious nodes(Muhammad et.al).

The system architecture for detecting fraudulent transactions and attacks in the BC network is based on Machine Learning. Using Machine Learning to check medical data from sensors and block abnormal data from entering the blockchain network(Mohammed et.al). Utilizing data structures known as sketches, specifically bloom filters and hyperLogLog, to identify suspicious accounts without requiring the examination of the entire blockchain data, develop methods to identify accounts with high transaction volume, frequency, and node degree(Voronov et.al ). Highlight how an interplay between blockchain and ML would allow both technologies to assist 130 cybersecurity-related use cases(Venkatesan et.al).

Finally, We add Table 1 summarizes and compares the main issues addressed in the existing literature.

Q2: Section 2.2 needs to clearly highlight the current research gap and analyse how this work is different from existing literature. While some discussion has been included, it requires clearer emphasis.

Response: Many thanks for the constructive suggestions! In this part, we add the emphasis part  “Table 1 summarizes and compares the main issues addressed in the existing literature, and we can find that one of the main limitations of the existing literature is that most of the studies focus only on specific cryptocurrencies or blockchain networks, which largely limits the broad applicability and generalization of the findings. In addition, there is a relative lack of research on the impact of different data preprocessing and feature selection techniques on the performance of anomaly detection based on user graph features. Meanwhile, the existing literature is also relatively scarce in comparative studies of different feature dimension reduction and data augmentation methods and their technical effectiveness in anomaly detection based on high-dimensional and sparse graph features in blockchain.

Given this, this study aims to evaluate the efficacy of these methods by constructing a comprehensive framework dedicated to generating, downgrading, and data-enhancing user graph features in blockchain networks evaluating the efficacy of these methods on multiple types of cryptocurrencies and blockchain networks. The core goal of this paper is to fill the gaps in the existing literature on blockchain abnormal behavior detection and to promote further development in the field. With this comprehensive approach, this paper expects to improve the generalizability and generalization of the anomaly detection models and to provide more effective solutions for blockchain network security. This research is dedicated to more effective blockchain abnormal transaction behavior identification methods, and through summary analysis, there are two urgent problems in the current blockchain abnormal transaction behavior identification methods in small sample scenarios: the first aspect is that the abnormal transaction mapping features in the blockchain are high-dimensional and sparse; the second aspect is that it is difficult to accurately detect the abnormal transaction behavior in the blockchain, especially in the case that the user transaction data is not a balanced situation.”.

To enhance the focus on our contributions, we have restructured section 2.2 for better emphasis, as follows:

Our study focuses on the challenges of small samples and high-dimensional sparse features in detecting abnormal transactions in the blockchain. To address these issues, we propose a novel method for generating informative topology features that can be used as input to machine learning models.

Generating informative transaction graph feature. Our approach involves constructing user transaction graphs using historical transaction data, reducing the feature dimensionality to alleviate sparsity, and employing data augmentation techniques to tackle the problem of a limited number of abnormal topology features in blockchain transactions. After reducing the dimensionality of user topology features, the abnormal topology features are subjected to data augmentation methods to generate the final user topology features. The application of Generative Adversarial Networks in generating minority abnormal topology features exhibits significant advantages in capturing the underlying features of genuine topology features and synthesizing new abnormal topology features that conform with the real transaction data.

Application of generative adversarial networks (GAN) for data augmentation. Abnormal transaction detection tasks are faced with the challenge that abnormal transaction samples usually constitute a negligible fraction of the entire transaction data set, thereby constraining traditional machine learning algorithms in their capability to learn features from limited abnormal samples and fabricate new abnormal transaction data. GAN, on the other hand, can generate fresh abnormal transaction data from a small set of abnormal transaction samples, augmenting the diversity and amount of abnormal transaction data and consequently improving the accuracy and dependability of abnormal account detection. Furthermore, GAN can bolster the robustness and generalization capacity of the model via adversarial training, augmenting the identification ability of unexplored abnormal transaction samples and enhancing the efficacy of abnormal account detection. Subsequently, We utilize machine learning models to predict and identify abnormal accounts in the blockchain.

Utilizing machine learning models for abnormal detection. Our proposed approach presents an efficient solution to augment the detection of abnormal accounts in blockchain transactions through the synthesis of informative topology features for machine learning models. The potential impact of our study is substantial, as it could facilitate the advancement of more secure and reliable blockchain systems, leading to greater adoption and integration of blockchain technology across diverse industries.

Q3: Section 3 heading “Material and methods” is a bit confusing. Please consider changing the heading.

Response: Many thanks for the constructive suggestions! We note your concern about the title of the "Materials and Methods" section and believe that it may cause some confusion. To improve the clarity and readability of the paper, we have changed the title of this section to "Methodology". We believe the new title more accurately reflects the content of the section, i.e., the methodological details of our study. We hope that this change will better guide the reader in understanding our research methodology and process.

Q4:There are quite a few cases of editing issues such as:

• spacing issue (space missing after “.” Or “,”) throughout the paper.
• Capitalisation within a sentence (line 98, 102 etc)
• typographical mistakes.

Response: Many thanks for the constructive suggestions! According to your suggestion, we carefully checked and revised incomplete sentences and editing spacing issue in the whole of the paper, not only including the above mentioned examples, but also including the other typos, such as:

In Abstract: change ".Recently" to ". Recently"

In Abstract: change ".To" to ". To"

In Abstract: change ".Our" to ". Our"

In Introduction: change ",   gambling" to ", gambling"

In Methodology: ".The objective" to ". The objective"

In Methodology: change ",  and $G(z)$ " to ", and $G(z)$ "

In Experiments: ".  The second moment" to ". The second moment"

In Experiments: ",which" to ", which"

In Experiments: ".The" to ". The"

In Related Works: change "We" to "we"

In Related Works: change "This" to "this"

In Methodology: "Abnormal detection model training by SVM algorithm. " As a title, it should be on a separate line.

In Methodology: "Abnormal detection model training by XGboost algorithm. " As a title, it should be on a separate line.

Regarding the typographical mistakes, We adjusted the position of Table 4, and Table 5 and deleted the empty line before Table 4, and Table 5. Then we removed the blank lines before Eq 4, and Eq5 and removed the blank lines before and after the equation.

We have thoroughly reviewed the manuscript and made the necessary corrections to the typographical errors that you have identified. Additionally, we have taken the opportunity to proofread the entire document to ensure that no further mistakes were overlooked.

It would be good if the font size of the text of Figure 1 could be increased.

Q5:It would be good if the font size of the text of Figure 1 could be increased.

Response: Many thanks for the constructive suggestions! According to your suggestion, we have adjusted the font size in Figure 1.

Round 2

Reviewer 3 Report

Authors have addressed the previous comments.