Beyond Node Attributes: A Controlled Evaluation and Ablation of Local Interaction Statistics for Ethereum Phishing Detection

원문 초록

Methods for detecting phishing accounts on Ethereum are usually evaluated as complete pipelines that differ in features, architecture, and training protocol, which makes the contribution of interaction information hard to isolate. This paper evaluates the Unlabeled Feature Extension (UFE), a block of 12 local interaction statistics computed from each account's incoming and outgoing call and transfer edges without reading class labels. UFE is appended to the 14 source features of HEIG-Phish and tested with six model families: Logistic Regression, Random Forest, LightGBM, Graph Attention Network, GraphSAGE, and Meta-IFD. Within each pair of Baseline and Plus variants, the data partition, model configuration, random seed, decision threshold, and sampled neighborhoods are identical; only the input feature block changes. Across 20 predetermined stratified partitions of the same 2,763 labeled externally owned accounts, UFE increased test Macro-F1 by 1.0 to 9.1 percentage points across the six models. Every pair improved on all 20 partitions, all Nadeau-Bengio corrected 95% confidence intervals lie above zero, and the false-positive rate decreased for all six models. An exact-edge Random Forest ablation over 10 predetermined partitions associates most of the gain with the incoming transfer-edge sum attribute; once this feature is present, an incremental contribution of the remaining 11 UFE columns was not established. The results support reporting feature-augmented baselines alongside graph models, but they show stability under re-partitioning of one static, transductive benchmark rather than temporal or cross-dataset generalization.