Datasetpublic

enes0o0/cross-chain-sybil-detection

Cross-Chain Sybil Attack Detection Dataset A large-scale, labeled dataset for detecting Sybil attacks in blockchain networks using cross-chain behavioral modeling. Dataset Description This dataset contains 196,477 wallet addresses collected from five blockchain networks (Ethereum, Polygon, Arbitrum, Optimism, and xDai) with 60 engineered features and binary Sybil labels. It was constructed to support research on automated Sybil wallet detection in decentralized… See the full description on the dataset page: https://huggingface.co/datasets/enes0o0/cross-chain-sybil-detection.

sourceHugging Facemitupdated 4mo agoView on Hugging Face

0likes11downloads

Dataset Card

Cross-Chain Sybil Attack Detection Dataset

A large-scale, labeled dataset for detecting Sybil attacks in blockchain networks using cross-chain behavioral modeling.

Dataset Description

This dataset contains 196,477 wallet addresses collected from five blockchain networks (Ethereum, Polygon, Arbitrum, Optimism, and xDai) with 60 engineered features and binary Sybil labels. It was constructed to support research on automated Sybil wallet detection in decentralized finance (DeFi) ecosystems.

Ground-truth Sybil labels were obtained from the Hop Protocol airdrop campaign, verified through clustering analysis, temporal pattern inspection, and funding source tracking.

Key Statistics

Metric	Value
Total wallets	196,477
Sybil wallets	14,195 (7.22%)
Normal wallets	182,282 (92.78%)
Features	60
Columns	62 (walletaddress + issybil_attacker + 60 features)
Blockchain networks	Ethereum, Polygon, Arbitrum, Optimism, xDai

Class Distribution

The dataset exhibits significant class imbalance (~7.22% Sybil), which is representative of real-world fraud detection scenarios.

Features

The 60 features are organized into the following groups:

Feature Group	Count	Description
Bridge Transaction	10	Cross-chain bridge usage counts and amounts per network
Aggregate	4	Total transaction counts, amounts, and airdrop received
Behavioral / Enhanced	6	Risk score, activity span, hour entropy, activity bursts, cluster info
Derived	4	Computed ratios: avgtransactionamount, networkdiversity, transactionratio, amount_ratio
Co-Temporal Graph (60s)	7	Burst coordination metrics within 60-second windows
Co-Temporal Graph (300s)	7	Burst coordination metrics within 300-second windows
Funding Graph	9	Funding source topology: in/out degree, sibling wallets, WCC size
Entity-Funding Cluster (EFC)	13	Cluster-level aggregates: size, risk, funding volume, diversity

Non-Feature Columns

Column	Description
`wallet_address`	Unique wallet identifier
`is_sybil_attacker`	Binary label: 1 = Sybil, 0 = Normal

Usage

python

from datasets import load_dataset

dataset = load_dataset("enes0o0/cross-chain-sybil-detection")
df = dataset["train"].to_pandas()

X = df.drop(columns=["wallet_address", "is_sybil_attacker"])
y = df["is_sybil_attacker"]

Benchmark Results

Models evaluated using 10x random train/test splits (80/20) with hyperparameter optimization:

Model	AUC-ROC	F1-Score	Type
LightGBM	0.9350 ± 0.0021	0.6164 ± 0.0087	Supervised (Boosting)
CatBoost	0.9327 ± 0.0013	0.5937 ± 0.0066	Supervised (Boosting)
RandomForest	0.9300 ± 0.0024	0.5756 ± 0.0040	Supervised (Bagging)
TabNet	0.8739 ± 0.0140	0.3978 ± 0.0324	Supervised (Deep Tabular)
IsolationForest	0.6940 ± 0.0043	0.1712 ± 0.0116	Unsupervised
OneClassSVM	0.5471 ± 0.0122	0.2185 ± 0.0060	Unsupervised

Associated Paper

An Interpretable and Robust Machine Learning Framework for Sybil Attack Detection Based on Cross-Chain Behavioral Modeling Berke Gunes (BIS Cozum Bilgisayar ve Entegrasyon Hizmetleri ve Tic. A.S, Istanbul), Enes Ozgozler (Bahcesehir University, Dept. of Computer Engineering, Istanbul), C. Okan Sakar (Bahcesehir University, Dept. of Computer Engineering, Istanbul)

This dataset is an extended version of the data used in the conference paper presented at MedPRAI 2026, expanded with co-temporal burst, funding graph, and entity-funding cluster features.

Citation

If you use this dataset, please cite the associated conference paper:

Gunes, B., Sakar, C.O.: Cross-chain behavioral modeling for sybil attack detection in blockchain networks. In: 7th Mediterranean Conference on Pattern Recognition and Artificial Intelligence (MedPRAI) (2026)

bibtex

@inproceedings{gunes2026medprai,
  title={Cross-Chain Behavioral Modeling for Sybil Attack Detection in Blockchain Networks},
  author={Gunes, B. and Sakar, C.O.},
  booktitle={7th Mediterranean Conference on Pattern Recognition and Artificial Intelligence (MedPRAI)},
  year={2026}
}

License

MIT