Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Identification of Unusual Wallets on Ethereum Platform

Identification of Unusual Wallets on Ethereum Platform

MACSPro'2019 - Modeling and Analysis of Complex Systems and Processes, Vienna
21 - 23 March 2019

Mikhail Petrov

Conference website http://macspro.club/

Website https://exactpro.com/
Linkedin https://www.linkedin.com/company/exactpro-systems-llc
Instagram https://www.instagram.com/exactpro/
Twitter https://twitter.com/exactpro
Facebook https://www.facebook.com/exactpro/
Youtube Channel https://www.youtube.com/c/exactprosystems


March 22, 2019

More Decks by Exactpro

Other Decks in Research


  1. Identification of Unusual Wallets on Ethereum Platform
    Mikhail Petrov
    March 22

    View Slide

  2. Data downloaded
    • Data on all transactions for a week was downloaded;
    • Totally information about 3,382,252 transactions were collected;
    • Transaction parameters:
    – address of the sender;
    – address of the receiver;
    – date and time of the transaction;
    – the amount of the internal currency (wei) that is transferred.

    View Slide

  3. Graph construction
    • The vertices of the graph are the wallets in the platform and also the edges are the transactions
    between these wallets.
    • Rename vertices by numbers, since addresses do not make any sense.
    • Sum the weights of the edges between identical pairs of sender and receiver.
    As a result, we obtained an undirected graph with positive and negative edge weights. The graph has
    1,577,010 vertices and 4,963,980 edges.

    View Slide

  4. Connectivity analysis
    The graph has 35,628 connectivity components. These components can be divided into three
    • The main component of a large community. In this component there are 1,474,024
    • The second type is a small groups of ten to a thousand people.
    • The third class includes groups of up to ten people.
    The first group has the greatest interest for analyzing.

    View Slide

  5. Vertex Characteristics
    Construct a 5-dimensional vector characterizing the vertices of the graph:
    • number of the k-core, which vertex belongs;
    • degree of a vertex;
    • Three kinds of centrality: betweenness centrality, closeness centrality and
    degree centrality.

    View Slide

  6. Clustering
    Based on the obtained vectors clustering is
    performed using the standard k-means method.
    To determine the optimal number of clusters all
    numbers from 0 to 200 in steps of 10 were
    chosen, clustering was performed and the
    result were checked with Silhouette and the
    shoulder methods.
    As a result, the optimal number of clusters was
    chosen to be 50.

    View Slide

  7. View Slide

  8. Association Rules

    View Slide

  9. Top strangeness rating
    For each ”suspicious” characterization points from 1 to 100 were given depending on the criticality:
    • associative rules – scores determined by the value of the support of the associative rule multiplied
    by one hundred.
    • vertices whose vectors are too far from the center of their clusters – scores by
    |mean − distance|

    where mean is the average distance to the center in the cluster, distance – distance to the center
    of a particular vector and is the maximum difference between the average and the
    distance from the vector to the center inside the cluster.
    • vertices, whose characteristics of the vectors also go beyond the limits of the mean ± variance
    (same formula, as well as with distances)
    • belonging to atypical small clusters

    View Slide

  10. Result
    After summing up all the points by the nodes the rating of the suspicious vertices for the exchange of
    the Ether was obtained. Below are the top of 5 values of this rating:

    View Slide