通过子图特征融合识别区块链空投中的僵尸地址，准确率超90%。
Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach
- 构建双层交易子图，提取时间、金额与网络结构特征
- 在19万地址数据上实现超过0.9的精确率、召回率和F1值
- 适用于防范交易操纵与代币流动性风险，适合安全研究者使用
Sybil攻击对区块链生态系统构成重大威胁，尤其在代币空投事件中。本文提出一种基于子图特征提取与lightGBM的新型僵尸地址识别方法。首先为每个地址构建两层深度交易子图，依据僵尸地址生命周期提取关键事件特征，包括首次交易时间、首次获取Gas时间、参与空投时间及最后一次交易时间。这些时间特征有效捕捉了僵尸地址行为的一致性。此外，还提取金额与网络结构特征，通过特征传播与融合全面描述地址行为模式与网络拓扑。在包含193,701个地址（其中23,240个为僵尸地址）的数据集上实验表明，该方法在精确率、召回率、F1分数和AUC指标上均优于现有方法，各项指标均超过0.9。研究成果可进一步应用于交易操纵识别与代币流动性风险评估，助力构建更安全、公平的区块链生态。
原文摘要 · Abstract (English)
Sybil attacks pose a significant security threat to blockchain ecosystems, particularly in token airdrop events. This paper proposes a novel sybil address identification method based on subgraph feature extraction lightGBM. The method first constructs a two-layer deep transaction subgraph for each address, then extracts key event operation features according to the lifecycle of sybil addresses, including the time of first transaction, first gas acquisition, participation in airdrop activities, and last transaction. These temporal features effectively capture the consistency of sybil address behavior operations. Additionally, the method extracts amount and network structure features, comprehensively describing address behavior patterns and network topology through feature propagation and fusion. Experiments conducted on a dataset containing 193,701 addresses (including 23,240 sybil addresses) show that this method outperforms existing approaches in terms of precision, recall, F1 score, and AUC, with all metrics exceeding 0.9. The methods and results of this study can be further applied to broader blockchain security areas such as transaction manipulation identification and token liquidity risk assessment, contributing to the construction of a more secure and fair blockchain ecosystem.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。