← 研踪 PaperTrailarXiv:2611.11263 · v1
Beyond Node Attributes: A Controlled Evaluation and Ablation of Local Interaction Statistics for Ethereum Phishing Detection
首次提交 2026-11-08 17:31
版本更新 2026-11-08 17:31
雷达观测 2026-11-10 12:16
摘要
Methods for detecting phishing accounts on Ethereum are usually evaluated as complete pipelines that differ in features, architecture, and training protocol, which makes the contribution of interaction information hard to isolate. This paper evaluates the Unlabeled Feature Extension (UFE), a block of 12 local interaction statistics computed from each account's incoming and outgoing call and transfer edges without reading class labels. UFE is appended to the 14 source features of HEIG-Phish and tested with six model families: Logistic Regression, Random Forest, LightGBM, Graph Attention Network, GraphSAGE, and Meta-IFD. Within each pair of Baseline and Plus variants, the data partition, model configuration, random seed, decision threshold, and sampled neighborhoods are identical; only the input feature block changes. Across 20 predetermined stratified partitions of the same 2,763 labeled externally owned accounts, UFE increased test Macro-F1 by 1.0 to 9.1 percentage points across the six models. Every pair improved on all 20 partitions, all Nadeau-Bengio corrected 95% confidence intervals lie above zero, and the false-positive rate decreased for all six models. An exact-edge Random Forest ablation over 10 predetermined partitions associates most of the gain with the incoming transfer-edge sum attribute; once this feature is present, an incremental contribution of the remaining 11 UFE columns was not established. The results support reporting feature-augmented baselines alongside graph models, but they show stability under re-partitioning of one static, transductive benchmark rather than temporal or cross-dataset generalization.
作者备注：13 pages, 4 figures, 3 tables
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-08 17:31 · 最新观测版本
Beyond Node Attributes: A Controlled Evaluation and Ablation of Local Interaction Statistics for Ethereum Phishing Detection
Methods for detecting phishing accounts on Ethereum are usually evaluated as complete pipelines that differ in features, architecture, and training protocol, which makes the contribution of interaction information hard to isolate. This paper evaluates the Unlabeled Feature Extension (UFE), a block of 12 local interaction statistics computed from each account's incoming and outgoing call and transfer edges without reading class labels. UFE is appended to the 14 source features of HEIG-Phish and tested with six model families: Logistic Regression, Random Forest, LightGBM, Graph Attention Network, GraphSAGE, and Meta-IFD. Within each pair of Baseline and Plus variants, the data partition, model configuration, random seed, decision threshold, and sampled neighborhoods are identical; only the input feature block changes. Across 20 predetermined stratified partitions of the same 2,763 labeled externally owned accounts, UFE increased test Macro-F1 by 1.0 to 9.1 percentage points across the six models. Every pair improved on all 20 partitions, all Nadeau-Bengio corrected 95% confidence intervals lie above zero, and the false-positive rate decreased for all six models. An exact-edge Random Forest ablation over 10 predetermined partitions associates most of the gain with the incoming transfer-edge sum attribute; once this feature is present, an incremental contribution of the remaining 11 UFE columns was not established. The results support reporting feature-augmented baselines alongside graph models, but they show stability under re-partitioning of one static, transductive benchmark rather than temporal or cross-dataset generalization.
查看此版本解读 →查看此版本原文 ↗