Tommy-DING/crypto-illicit-account-detection-multigraphs

Crypto Illicit Account Detection Multigraphs (DIAM)

<p align="left"> <img src="assets/multigraph.png" alt="OSC Examples" width="400"> </p>

This dataset repository (`Tommy-DING/crypto-illicit-account-detection-multigraphs`) provides four large-scale directed multigraph cryptocurrency transaction networks used in:

Effective Illicit Account Detection on Large Directed MultiGraph Transaction Networks of Cryptocurrencies Zhihao Ding, Jieming Shi, Qing Li, Jiannong Cao. CIKM 2024.

The primary task is illicit account detection (node-level classification) on transaction graphs.

Official PyTorch Geometric implementation & `.pt` data: https://github.com/TommyDzh/DIAM

Dataset Contents

This repo contains NumPy compressed archives (`.npz`):

• —EthereumS_graph_dict.npz
• —EthereumP_graph_dict.npz
• —BitcoinM_graph_dict.npz
• —BitcoinL_graph_dict.npz

Each file stores a single large transaction graph as a graph dictionary (see below).

Data Format (.npz graph dict)

Each *_graph_dict.npz contains the following keys:

• —edge_index: shape [2, E] Directed edge list in COO format (source nodes in row 0, destination nodes in row 1).

• —edge_attr: shape [E, D] Edge attributes (transaction-level features).
• —Ethereum-S / Ethereum-P: D = 2 (transaction amount, timestamp)
• —Bitcoin-M: D = 5 (input amount, output amount, #inputs, #outputs, timestamp)
• —Bitcoin-L: D = 8 (input amount, output amount, #inputs, #outputs, fee, total inputs value, total outputs value, timestamp)

• —X: shape [N, F] Node features (pre-computed / feature-engineered). The paper reports feature dimensions of:
• —Ethereum-P: F = 48
• —Ethereum-S: F = 48
• —Bitcoin-M: F = 69
• —Bitcoin-L: F = 89 Note: DIAM itself learns node representations from edge-attribute sequences and does not require these engineered node features, but they are provided for convenience and for running feature-based baselines.

• —y: shape [N] Node labels in {-1, 0, 1}:
• —-1: unknown / unlabeled
• —0: benign / normal
• —1: illicit

Loading Example

import numpy as np

z = np.load("EthereumS_graph_dict.npz")
edge_index = z["edge_index"]  # [2, E]
edge_attr  = z["edge_attr"]   # [E, D]
X          = z["X"]           # [N, F]
y          = z["y"]           # [N]

Convert to PyTorch Geometric Data

import numpy as np
import torch
from torch_geometric.data import Data

z = np.load("EthereumS_graph_dict.npz")

data = Data(
    x=torch.from_numpy(z["X"]).float(),
    edge_index=torch.from_numpy(z["edge_index"]).long(),
    edge_attr=torch.from_numpy(z["edge_attr"]).float(),
    y=torch.from_numpy(z["y"]).long(),
)

Datasets & Label Semantics (per paper)

The repo includes two Ethereum graphs and two Bitcoin graphs:

• —Ethereum-S / Ethereum-P: illicit nodes correspond to addresses conducting phishing scams.
• —Ethereum-P originally contains illicit labels; benign labels are enhanced by identifying benign accounts (e.g., wallets / finance services) from Etherscan.

• —Bitcoin-M / Bitcoin-L: illicit nodes correspond to Bitcoin addresses belonging to gambling and mixing services (strongly associated with money laundering). Other types are treated as normal.

Ground-truth labels are crawled from public sources including Etherscan and WalletExplorer, as described in the paper.

Recommended Usage

• —For the official DIAM pipeline (edge sequence generation, training, and evaluation), follow the GitHub instructions: https://github.com/TommyDzh/DIAM

• —If you train your own models directly on these .npz graphs, a common practice is:
• —use nodes with y in {0,1} as labeled set,
• —ignore y == -1 during supervised loss/evaluation,
• —construct train/val/test splits according to your experimental protocol (the DIAM repo provides the reference implementation).

Citation

If you use this dataset, please cite:

@inproceedings{ding2024effective,
  title={Effective illicit account detection on large cryptocurrency multigraphs},
  author={Ding, Zhihao and Shi, Jieming and Li, Qing and Cao, Jiannong},
  booktitle={Proceedings of the 33rd ACM International Conference on Information and Knowledge Management},
  pages={457--466},
  year={2024}
}