从以太坊数据中挖掘长期稳定的用户行为模式，助力区块链溯源与风险识别。
Discovering Persistent Behavioural Patterns for Interpretable Blockchain Forensics
- 构建带上下文的行为句，分两步嵌入捕捉个体动作与时间序列行为。
- 在超3000万笔交易上发现稳定存在的常规与恶意行为模式。
- 支持执法、审计人员追踪长期异常行为，解释性强且可扩展。
公开区块链数据为大规模DeFi分析提供了可能，但现有方法多具应用局限性，难以扩展或解释。本文提出一种可扩展、无应用依赖的持久行为模式发现框架，通过构建融合合约、代币和市场信息的行为句，采用两级嵌入：句子级嵌入捕捉单个操作，序列级嵌入刻画用户随时间的行为轨迹。一个可解释的行为画像器通过行为特征、例行模式、时间动态、实体暴露度及可疑证据等维度刻画发现的社区。在以太坊上基于超过3000万笔交易的评估表明，该框架成功揭示了去中心化交易所交易、NFT活动、钓鱼攻击、机器人操作、预言机操纵及跑路骗局等行为模式。重要的是，许多模式在独立观察窗口间保持稳定，可识别跨周期长期行为。该框架结合了可扩展性、可解释性与持久性分析能力，适用于区块链溯源、行为归因与威胁发现。
原文摘要 · Abstract (English)
Public blockchain data enables large-scale DeFi-related analysis, but many existing approaches are application-specific, difficult to scale, or hard to interpret. This research proposes a scalable, application-agnostic framework for \emph{persistent behavioural pattern discovery} from large-scale blockchain activity. It constructs behaviour sentences enriched with contract, token and market context, then applies a two-step embedding process: sentence-level embeddings capture individual actions, while sequence-level embeddings capture user behaviour over time. An interpretable behavioural profiler characterizes discovered communities through behavioural motifs, routines, temporal dynamics, entity exposure, and suspiciousness evidence. Evaluation on Ethereum using over 30 million transactions shows that the framework uncovers both routine and malicious behavioural patterns, including decentralised exchange (DEX) trading, NFT activity, phishing, bot operations, oracle manipulation, and rug-pull schemes. Importantly, many patterns remain stable across independent observation windows, enabling the identification of long-term behaviours beyond a single analysis period. The proposed framework combines scalability, interpretability, and persistence analysis, supporting blockchain forensic investigation, behavioural attribution, and threat discovery.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。