Received 17 August 2023, accepted 4 September 2023, date of publication 11 September 2023,

date of current version 14 September 2023.

Digital Object Identifier 10.1109/ACCESS.2023.3313630

Abnormal Transactions Detection in the

Ethereum Network Using Semi-Supervised
Generative Adversarial Networks
YOUSEF K. SANJALAWE 1, AND SALAM R. AL-E’MARI 2
1 Cybersecurity Department, School of Information Technology, American University of Madaba, Amman 11821, Jordan
2 Information Security Department, Faculty of Information Technology, University of Petra, Amman 11196, Jordan

Corresponding author: Salam R. Al-E’mari ([email protected])

ABSTRACT Numerous abnormal transactions have been exposed as a result of targeted attacks on
Ethereum, such as the Ethereum Decentralized Autonomous Organization attack. Exploiting vulnerabilities
in smart contracts, malicious users can pursue their own illicit objectives through abnormal transactions.
Consequently, identifying these malevolent users, implicated in fraudulent activities and their attribu-
tion, becomes exceedingly complex. Cryptocurrency transactions used for malicious purposes, employing
pseudo-anonymous accounts to send and receive ransom payments and accumulating funds under various
identities, further highlight the need to control and detect these abnormal transactions for maintaining
a high level of security within the Ethereum network. Although existing Intrusion Detection Systems
(IDSs) help mitigate abnormal transaction occurrences, their performance necessitates improvement.
To address this issue, this study presents a novel approach, named Abnormal Transactions Detection Using a
Semi-Supervised Generative Adversarial Network (ATD-SGAN), which efficiently detects abnormal attacks
within the Ethereum network. ATD-SGAN leverages a semi-supervised generative adversarial network for
this purpose. The results demonstrate that ATD-SGAN significantly enhances the performance of state-of-
the-art IDSs. It achieves an increase in detection accuracy from 3.78% to 11.05% and reduces the false alarm
rate from 42.29% to 0.15%. Moreover, ATD-SGAN notably improves the F1-measure, ranging from 10.39%
to 3.79%, compared to the current IDSs.

INDEX TERMS Abnormal transactions, ethereum, feature selection, intrusion detection system, network
security.

I. INTRODUCTION of blockchain networks allows criminals to conceal their true

Illicit activities, including money laundering, phishing, and identities, making it an attractive feature for carrying out
fraud, have cast a shadow over the advancements made abnormal or malicious activities.
in cryptocurrencies and the accompanying advantages they Furthermore, the increasing reliance on the Ethereum
offer, as highlighted in a study on detecting such activities network for various aspects of our lives, including cryp-
on the blockchain network [1]. Due to the substantial volume tocurrencies and decentralized apps (DApps), has resulted
of sensitive data they handle, these technologies are vulner- in a surge in Ethereum transactions. However, this has also
able to a range of malicious actions, attacks, and security captured the attention of attackers who exploit vulnerabilities
threats that pose risks to the availability and integrity of in Ethereum contracts, transactions, and the Ethereum Virtual
information and services. Unlawful behaviors have had a Machine (EVM) to devise a range of attack methods aimed at
substantial impact on financial systems like Ethereum, intro- stealing Ethereum or disrupting the Ethereum market [2]. It is
ducing unprecedented challenges. The pseudonymous nature important to note that Ethereum, which is built on blockchain
technology, comprises two types of transactions. The first
The associate editor coordinating the review of this manuscript and type involves external transactions used for cryptocurrency
approving it for publication was Kashif Saleem . exchanges, while the second type entails internal transactions
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.
98516 For more information, see https://creativecommons.org/licenses/by-nc-nd/4.0/ VOLUME 11, 2023
Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

executed by smart contracts or DApps. Internal transactions datasets. The characteristics of self-prepared datasets in terms
require gas to execute, and this gas is acquired through exter- of attack coverage, accuracy, and validity are not revealed.
nal transactions using the Ether cryptocurrency [2], [3]. Therefore, it is imperative to develop resilient IDSs that can
Although blockchain networks are secure, they are exposed improve detection accuracy, decrease the false alarm rate,
to security vulnerabilities. Consequently, intruders have and enhance the detection rate when identifying anomalous
emerged in Ethereum networks and made thefts of millions transactions within the Ethereum network. This paper aims
of Ethers. For instance, a Decentralized Autonomous Orga- to accomplish the following objectives:
nization (DAO) attack occurred in 2016 and over $50M • To adopt a multi-digraph theory to extract a set of fea-
was stolen [4], [5]. In addition, $13M of Ether was stolen tures for the Ethereum transactions.
by a parity multi-sig wallet attack in July 2017 and a new • Proposed multi-objective function to reduce the dimen-
version from this attack stole $155M of Ether in November sionality of the dataset and improve detection perfor-
2017 [6]. Further, in 2018 integer flow attack stole $2.3 M of mance.
Ether [7]. While $48.7 M of Ether was stolen by an unknown • Proposed ensemble feature selection mechanism to
address account in South Korea through a cryptocurrency select the most significant features that contribute to
exchange [8], and $48.7 M of Ether was stolen by a 51% detecting abnormal transactions in the Ethereum net-
attack in 2020 [9]. Besides that, several attacks attempted to work efficiently.
steal cryptocurrencies from the Ethereum network or other • To adapt automatic data augmentation mechanism to
malicious actions. All the above-mentioned attacks generate avoid overfitting and achieve impressive detection per-
a huge number of abnormal transactions, therefore; detection formance from few labeled transactions used in training
of these abnormal transactions led to detecting the attacks • To evaluate ATD-SGAN approach
that target the Ethereum network. On the other hand, the
conventional IDS are unable to detect abnormal transactions
A. PAPER ORGANIZATION
because the Ethereum network has a new complex environ-
ment and infrastructure. Therefore, it is essential to propose The structure of this paper is as follows: Section II provides
an IDS approach mainly to detect abnormal transactions in an overview of the related works on intrusion detection in
the Ethereum network, the security, detection, and protection the Ethereum network; Section III introduces the proposed
of the various communication infrastructures using Intrusion IDS approach; Section IV presents the experimental results;
Detection Systems (IDSs) are of critical importance. Section V discusses the outcomes; and finally, Section VI
To this end, IDS is a security tool that monitors network concludes the paper.
traffic for signs of cyber-attacks or malicious activity. It can
be used to detect and prevent attacks on Ethereum networks, II. RELATED WORKS
as well as to identify and alert on suspicious activity. There Several research studies have been undertaken to identify
are several types of IDS that can be used for Ethereum, abnormal transactions using blockchain networks. Further-
including network-based, host-based, and wireless IDS. The more, the present work utilizes a learning model based on the
importance of an IDS in Ethereum lies in its ability to pro- anomaly detection approach. In contrast, machine learning
vide an additional layer of security to protect against attacks and deep learning techniques can aid IDSs in automati-
and malicious activity. By continuously monitoring network cally detecting both new and existing attacks without the
traffic and alerting on suspicious activity, an IDS can help need for human intervention by optimizing feature selec-
to identify and prevent potential threats before they can tion. In recent times, numerous machine learning and deep
cause harm [10]. Generative Adversarial Networks (GANs) learning algorithms, such as support vector machines and
comprise a pair of neural networks, namely the generator artificial neural networks, have been incorporated into IDSs
and the discriminator, which collaborate in the identification to bolster system security. Moreover, a Convolutional Neural
and classification of network data. The generator generates Network (CNN) incorporating a self-attention mechanism
synthetic data to train the discriminator, whose role is to has been employed to construct the ABCNN (Attention-based
discern between real and synthetic data. As the generator Convolutional Neural Network) model for the purpose of
and discriminator undergo training, the generator becomes identifying vulnerabilities in smart contracts. The ABCNN
proficient in generating lifelike synthetic data, while the dis- model utilized a self-curated dataset by manually collecting
criminator becomes adept at distinguishing between real and 8632 verified smart contracts from Etherscan. This dataset
synthetic data. GANs can enhance the precision of an IDS by was prepared to facilitate the training and evaluation process.
augmenting the volume of available training data and aiding The ABCNN model demonstrated superior performance with
the IDS in generalization, enabling the detection of novel a reduced missing rate and faster execution time. Addition-
attack types [11], [12]. ally, it successfully detected three types of attacks, namely:
However, there is still a need to improve the performance (i) Reentrancy, (ii) Arithmetic issues, and (iii) Time manipu-
of the existing IDS in terms of detection accuracy and reduce lation [13].
the false-positive rate as these approaches do not evaluate on a The ESCORT model employed deep learning networks and
real dataset and are usually evaluated using only self-prepared Transfer Learning (TL) to effectively identify both known

VOLUME 11, 2023 98517

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

and unknown vulnerabilities, addressing the scalability and constructed, containing only 6 selected features. The experi-
generalization limitations present in previous research efforts. mental results demonstrated significant enhancements in time
ESCORT utilizes a multi-output neural network architec- measurements across all three algorithms, while the Random
ture comprising two main components: (i) A shared feature Forest algorithm exhibited improved performance in terms of
extractor that learns the semantics of the input smart con- the F-measure.
tract, and (ii) Multiple branch structures where each branch Within the framework of the escalating adoption of
focuses on learning a specific vulnerability type using the Ethereum and the subsequent proliferation of smart
extracted features from the feature extractor. The research contract-driven decentralized applications (DApps), the fre-
paper provides a thorough assessment of ESCORT’s perfor- quency of malicious attacks targeting this ecosystem has
mance on different smart contracts, successfully detecting six surged. Notably, frontrunning attacks exploit transaction
vulnerability types as well as identifying new vulnerability latency within the pending pool by manipulating gas prices,
types through the application of TL. ESCORT achieved a thereby posing a serious threat to DApp security. Thus, the
better detection accuracy rate in the empirical results [14]. authors in [18] proposed a model-based defense mecha-
In addition, a new model to detect abnormal transactions in nism based on Multi-Layer Perceptron (MLP). The proposed
the Bitcoin network is proposed by utilizing the K-Nearest model aims to discern whether a transaction exhibits indi-
Neighbours (KNN) algorithm and by testing the model on cators of a frontrunning attack. By involved the extraction of
the Elliptic dataset which has 203,769 nodes and 234,355 transaction-specific features, which are then transformed into
edges. In addition, the Elliptic dataset classifies the data into feature vectors for real-time analysis, and extensive experi-
three categories illicit, licit, or unknown. On the other hand, ments on a comprehensive transaction dataset. In addition, the
the Elliptic dataset has 166 features for each node where study in [19] introduced a model that combines Generative
94 features represent local information about the transaction Adversarial Networks (GAN) and Deep Recurrent Neural
and 72 features are called aggregated features. However, Networks (RNN) for cyber threat identification within the
the proposed approach has higher accuracy, but the rate of Ethereum blockchain. The proposed model follows a two-
detection and precision is not efficient [15]. phase approach, the first phase of the model utilized GAN to
Besides, a supervised machine learning-based anomaly produce fake transactions by leveraging genuine Ethereum
detection method was used, in [16], to identify malicious transactions as a foundation. Subsequently, the second
nodes by analyzing the transaction behavior of accounts. phase employed a bi-directional Long Short-Term Memory
Supervised machine learning models were applied to two dif- (LSTM) mechanism to detect adversarial transactions during
ferent types of accounts: Externally Owned Accounts (EOA) a cyber threat hunting process. As a result, the model achieved
and smart contract accounts. These models achieved a detec- in the first phase an accuracy of 82.51% in generating trans-
tion accuracy of 96.54% with a false-positive ratio of 0.92% actions closely resembling authentic Ethereum transactions.
for EOA accounts and 96.82% with a false-positive ratio In the second phase, the model demonstrated high perfor-
of 0.78% for smart contract accounts. During the period mance with a 99.98% accuracy rate in identifying adversarial
from 20 January 2020 to 24 February 2020, the method transactions. Furthermore, in [20], a method is introduced to
identified 85 new malicious EOA and 1 malicious smart detect fraudulent activities within the Ethereum blockchain
contract address. When tested on these addresses, the model’s through the analysis of transaction records. This approach
accuracy was 96.21% with a false-positive ratio of 3%. More- entails the use of web crawlers to gather labeled fraudulent
over, the authors proposed a framework to detect abnormal addresses. Subsequently, a transaction network is constructed
entities in the Ethereum network through several machine using the available public transaction ledger. For the pur-
learning methods: Logistic Regression (LR), Support Vec- pose of identifying fraudulent transactions, a specialized
tor Machine (SVM), Random Forest (RF), Stacking, and algorithm based on network embedding is employed. This
AdaBoost in [1]. First, the dataset was gathered from Ether- algorithm is tailored for networks structured by transaction
scan.io, and then all instances of this dataset were labeled amounts. It extracts features from the nodes in the network.
by Ethereum community members (i.e. experts). After that, Notably, the study [20] adopts a Graph Convolutional Net-
the re-sampling technique was used to handle the nature of work (GCN) model for the classification of addresses into
the imbalanced dataset. As a result, the proposed frame- legitimate or fraudulent categories. The experimental results
work achieves high performance in the classification of the showcase an impressive accuracy of 95%, underscoring the
Ethereum entities for the Stacking, and AdaBoost learning system’s effectiveness in pinpointing fraudulent transac-
methods. Furthermore, a fraud detection model was proposed tions within the Ethereum blockchain. Despite the challenge
to identify illicit accounts on the Ethereum blockchain in [17]. posed by an unlabeled dataset for evaluating the approach’s
The model utilized three machine learning algorithms: deci- performance, the trimmed k-means algorithm successfully
sion tree (j48), Random Forest (RF), and KNN. A dataset identified known instances of anomalies.
comprising 42 features was obtained from Kaggle.com and On the other hand, the arena of mitigating Distributed
subsequently, the correlation coefficient was employed to Denial-of-Service (DDoS) attacks has become a focal point
select the most impact features. A new dataset was then for extensive research endeavors. Concurrently, emerging

98518 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

technologies, with blockchain at the forefront, present gathering: which aims to propose gathering transactions and
promising avenues for groundbreaking solutions. In [21], labeling the transactions, (ii) data pre-processing: which aims
the authors introduced Cochain-SC, an inventive approach to increase the quality of the dataset by eliminating noisy
anchored in blockchain technology. Cochain-SC pioneers data, (iii) feature extraction: aims to extract feature based
a two-tiered mitigation framework that encompasses both multi-digraph theory, (iv) ensemble feature selection: aims
intra-domain and inter-domain scenarios of DDoS attacks. to select a mutual feature from two bio-inspired algorithms
Harnessing the capabilities of software-defined networks and (v) abnormal transactions detection: to detect abnormal
(SDN) in conjunction with the secure decentralization transaction utilized SGAN in Ethereum network as shown in
facilitated by blockchain, Cochain-SC devises a pio- Figure 1.
neering strategy that amalgamates these technologies to
achieve robust, collaborative, and effective mitigation out- A. BLTE DATASET
comes. This entails the fusion of SDN-based intra-domain Benchmark Labelled Transactions Ethereum (BLTE) is a
mechanisms responsible for classifying and mitigating benchmark dataset that gathers based on a real Ethereum
flows with blockchain-enabled inter-domain cooperation network called Ethereum Classic (ETC) network [24], and
facilitated by smart contracts. In addition, Co-IoT is it is a real chain, public, open-source, and distributed plat-
a novel blockchain-based framework designed for col- form. ETC has many tables, but ATD-SGAN chooses the
laborative DDoS mitigation. By leveraging the capabil- Transactions table with seventeen features as shown in Fig
ities of SDN and blockchain technology, particularly 5. These transactions are performed by EOA which deals
Ethereum’s smart contracts, Co-IoT aspires to foster collab- with external transactions and records them on blockchain
orative efforts among SDN-based domains. The framework’s to exchange cryptocurrency transactions [25]. According to
decentralized approach facilitates the exchange of attack- Figure 1 the first stage (Ethereum Dataset Generation), and
related information, aiming to enhance flexibility, efficiency, second stage (pre-processing) have been implemented and
security, and cost-effectiveness in combating large-scale discussed in former research minutely [24].
DDoS attacks [22]. Furthermore, The field of safeguard- However, the seventeen features of the transaction table
ing blockchain nodes faces a significant breakthrough with suffer from two main problems. The first problem is that
the introduction of BrainChain, an innovative and scal- these features, in their current form, do not contribute to
able solution designed to counteract the most extensive the detection of abnormal transactions and need to be fur-
DDoS attack witnessed, specifically the Domain Name Sys- ther analyzed to derive new features that contribute to the
tem (DNS) amplification attack. BrainChain is meticulously detection of abnormal transactions, while the second problem
crafted within SDN to protect and enhance the resilience is that the transaction table is unable to be automatically
of blockchain nodes. This scheme is composed of four piv- labeled (i.e in case of the transaction does not exist in Ether-
otal components namely: (i) The Flow Statistics Collection scamdb). The first problem is tackled in the feature extraction
scheme (FS), (ii) The Entropy-Based scheme (ES), (iii) The stage (refer to Section III-C) while the second problem is
Bayes Network-Based Filtering scheme (BF), and (iv) The tackled in the abnormal transactions’ detection stage (refer
DNS Mitigation scheme (DM). where the empirical assess- to SectionIII-E). ATD-SGAN obtains abnormal transactions
ment affirms the formidable capabilities of BrainChain in from Etherscamdb,1 which is open-source and available on
promptly and accurately identifying and countering DNS GitHub.2
amplification attacks [23].
Despite the numerous research studies conducted to detect B. DATA PREPROCESSING STAGE
abnormal transactions in two prominent blockchain net- Data pre-processing is a significant stage that can enhance
works, Bitcoin and Ethereum, these studies continue to the performance of intrusion detection systems [26]. The
face certain common challenges. One such challenge is the proposed model begins cleansing data by eliminating the
absence of a definitive ground truth to evaluate the effective- irrelevant features including any feature that has a null value
ness of any proposed model. Additionally, there are multiple or the same value for all Ethereum transactions in BLTE. Con-
cybersecurity concerns across different layers that further sequently, thirteen out of seventeen features are confirmed in
complicate the detection process. BLTE. Table 1 presents the description for each feature.
Therefore, the BLTE dataset holds great importance in
III. PROPOSED IDS APPROACH evaluating detection systems that heavily depend on labeled
This paper proposes an abnormal transactions-based detec- data, specifically transactions. Consequently, within the
tion approach, called ATD-SGAN, in the Ethereum network BLTE dataset, every transaction has been categorized as
using SGAN. The proposed approach enhances the detec- either a normal or abnormal transaction. Each transaction
tion performance while detecting abnormal transactions in involves two addresses: the sender and the receiver. Abnormal
the Ethereum network. The aim of this approach is to transactions are characterized by originating from intrusion
detect abnormal transactions using a semi-supervised learn-
ing method and deep learning. The proposed approach 1 https://etherscamdb.info
consists of five main stages, namely: (i) Ethereum data 2 https://github.com/MrLuit/EtherScamDB

VOLUME 11, 2023 98519

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

FIGURE 1. The main stages of ATD-SGAN.

TABLE 1. Transactions table. TABLE 2. Statistics of the BLTE dataset.

classification accuracy of the model. The reduction method

is one approach to processing imbalanced data [27].
The ATD-SGAN approach leverages the instance selection
technique to reduce the count of a specific class in the training
data since the generated dataset in BLTE contains a lower
count of abnormal transactions as compared to normal trans-
actions; therefore, the instance selection is used to reduce the
number of normal transactions as it does not affect the model
performance [28]. BLTE reduced the size of normal transac-
tions for compatible abnormal transactions in the dataset by
Local Density-based Instance Selection (LDIS) and Table 2.
summarizes information on the total number of Ethereum
transactions in the BLTE.
Ultimately, the scaling step refers to converting values of
attributes in a dataset in a specific range. The two main
methods of scaling are standardization and normalization.
Standardization transforms attribute values based on Gaus-
sian distribution, while normalization transforms attribute
values to a common scale with a specific range. Whereas
machine learning algorithm always benefits from the nor-
source addresses, being targeted addresses, or involving both. malization method to convert the values in a dataset without
Let training data be (T) = (I, Trx, S, R), where I, Trx, S, distorting variation in its range [29].
and R are a transaction Id, transaction, sender, and receiver, There are various normalization methods such as Min-
respectively. Further, Trx ∈ {0,1} is a binary classification, Max, Z-score, and so on. ATD-SGAN applies the common
0 indicates normal Trx and 1 indicates abnormal Trx. Even- one in a Min-Max normalization due to its enhanced speed
tually, BLTE has sixteen features, thirteen after the cleansing learning model, which scales data between 0 and 1 according
step, and inserting three features from the labeling step that to Equation (1) where a symbol X is a numerical value, Xmax ,
is from scam to scam and scam. Then, balancing data is a Xmin is the maximum and minimum values of the attribute,
significant concern when preparing a dataset to increase the respectively. While Xnorm ∈ [0,1] is a new value for the

98520 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

attribute [30]:
X + Xmin
Xnorm = (1)
Xmax − Xmin
However, each dataset consists of features (attributes),
such as, in BLTE dataset, All degree, In degree, Out degree,
Unique in degree, Unique out degree, Avg amount incom-
ing, Avg amount outgoing, Total amount incoming, Total
amount outgoing, Max amount incoming, and Total Amount
(described in Table 3). In fact, feature engineering is the
process of selecting and creating important features from raw
data that can be used to train a machine learning model. In the
context of an intrusion detection system, feature engineering
is the process of identifying and creating features that can
accurately classify malicious activity. This is important for
FIGURE 2. Sample of multi-digraph of Ethereum nodes.
ensuring that the IDS can effectively detect and respond
to threats while minimizing false positives, or instances of
normal activity being incorrectly classified as malicious.
By carefully selecting and creating relevant features, it is is (timestamp) of the transaction occurred [34], [35]. Indeed,
possible to build an IDS that is effective at detecting and multi-digraph allows multiple transactions between nodes
responding to real threats while minimizing disruptions to which is necessary to record the information of the Ethereum
normal network activity [31], [32]. node.
In machine learning, statistical analysis, and deep learning, Table 3 presents the results of feature extraction. How-
in particular, feature selection is the process of selecting a ever, the 22 features do not contribute to the detection of
subset of relevant features for use in model construction. abnormal transactions. Thus, an ensemble Bio-Inspired fea-
The goal of feature selection is to select the most useful ture selection mechanism has been proposed to select the
features in predicting the response while excluding irrelevant most significant features that contribute to the detection accu-
or redundant features. The chosen features should be able to racy of abnormal transactions. On the contrary, the existing
effectively predict the response variable and should not be approaches that ignore or select the features are based on
highly correlated with each other. Therefore, the following simple heuristics.
subsections discuss the feature extraction and selection used
in this paper in detail. D. ENSEMBLE BIO-INSPIRED FEATURE SELECTION STAGE
To enhance the performance of ATD-SGAN, it is crucial
C. FEATURE EXTRACTION STAGE to eliminate irrelevant features after the process of feature
Feature extraction is a process to extract subset features extraction. This helps to reduce redundant data, improve the
from input data that improves the accuracy of learned mod- accuracy of the prediction model, and decrease the training
els [33]. According to existing studies, several features have phase duration [36]. Feature selection is employed by ATD-
been extracted using weighted multi-digraph from Bitcoin SGAN, utilizing two bio-inspired algorithms: (i) Manta Ray
and Ethereum networks as mentioned in Table 1. In the Foraging Optimization (MRFO), and (ii) Particular Swarm
ATD-SGAN approach, 22 features have been extracted from Optimization (PSO). Subsequently, ATD-SGAN identifies
sixteen features from BLTE based on multi-graph theory. the common features from the outcomes of these two algo-
Whereas the Ethereum network is a graph G = (N , E), where rithms using a novel multi-objective function. The subsequent
(N) presents as a node of the Ethereum address, and (E) is a subsections provide a comprehensive explanation of the fea-
transaction edge that links between two Ethereum addresses ture selection mechanism employed by ATD-SGAN.
if the edge has weight or value, then it is a weighted graph;
otherwise, it unweighted graph. However, there are several 1) FEATURE SELECTION BASED MRFO
types of graphs, but the Ethereum network is a weighted MRFO is a bio-inspired meta-heuristic algorithm for fea-
multi-digraph in which each node has multiple weighted ture subset selection, which is used to enhance the feature
edges from the source node to the target node, this paper selection stage due to its effectiveness in feature selec-
used the Neo4j graph database to present and analyze the rela- tion, as well as it needs a smaller number of iterations
tionship (transactions) between Ethereum addresses (nodes) and configuration settings to converge (i.e., reaching the
for BLTE dataset. Figure 2 demonstrates an example for one optimum), which are major concerns in any feature selec-
Ethereum node, where node 2 is a sender and other nodes are tion problem [37], [38], [39], [40]. Thus, the MRFO is
receivers. Furthermore, each edge has four essential values utilized to reduce the dimensionality of the dataset con-
tuples (s, u, v, t) where s is the source node (sender), u is sequently decreasing the complexity of detection compu-
the target node (receiver), v is (value) of the transaction and t tation and enhancing the overall detection performance by

VOLUME 11, 2023 98521

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

TABLE 3. Features code.

the range of [0, 1], and α is a weight coefficient as shown

in Equation (3), x best d(t) is the plankton with high condensa-
tion [41].

α = 2.r. | log(r)|
p
(3)

FIGURE 3. a) Manta Ray’s body, (b) Manta Rays’ physical Manta rays exhibit fascinating behavior when they detect
construction [39].
a patch of plankton with a high concentration in deep water.
They form a long foraging chain and swim in a spiral pat-
tern toward the food, known as the cyclone feed strategy.
avoiding irrelevant or duplicated features (if any). The MRFO The equations describing this strategy can be observed in
algorithm was inspired by the feeding strategies of Manta Equation (4) and Equation (5) [40].
rays, which are the largest deep-sea creatures, Figure 3
demonstrates the body of the Manta ray. The properties of
 d d
Manta rays are body flat, swimming smoothly, largemouth,  xbest (t) + r.(xbest (t) − xid (t))
and plankton is the main food [39].

 +β.(x est d (t) − x d (t)),

if 1
b
The MRFO algorithm draws inspiration from three forag- xid (t + 1) = d d
i
d
 xbest (t) + r.(xi−1 (t) − xi (t))
ing strategies observed in Manta rays: (i) Chain, (ii) Cyclone, 

+β.(xb est d (t) − xid (t)),

and (iii) Somersault [41]. In the Chain feed strategy, Manta i=2,. . . ,N
rays observe the position of plankton and swim toward it. (4)
The concentration of plankton in a particular position plays r1 ∗ T −t+1
β = 2.e T (5)
a crucial role, as a higher concentration signifies a better
solution. The equations describing this strategy are presented
in Equation (2) [41]. In the MRFO algorithm, the weight coefficient β is
 d
 d
xi (t) + r.(xbest (t) − xid (t)) employed, while T represents the maximum number of iter-

 +α.(x d (t) − x d (t)),
 ations. The variable r1 denotes a random number within the
if 1
xid (t + 1) = d
best
d
i
d
range ∈ [0, 1]. Each individual within the algorithm performs
x
 i

 (t) + r.(x (i−1) (t) − xi (t)) a random search, utilizing the best-found plankton position
d
(t) − xid (t)),

+α.(xbest i=2,. . . ,N as a reference point. Moreover, to enhance the exploration
(2) capability of the MRFO algorithm, Equation (6) and Equation
(7) are employed. These equations compel the manta rays to
where x i d(t) refers to the position of t th individual at time t search for new positions by assigning a random position as
in d th dimension. while r refers to a random vector within their reference point, thus enabling a more extensive global

98522 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

search [40]. TABLE 4. Values of the objectives’ weights.

d
xrand = Lbd + r ∗ (Ubd − Lbd ) (6)
 d d

 xrand (t) + r.(xrand (t) − xid (t))
 +β.(x and d (t) − x d (t)),

if 1
r
xid (t + 1) = d
i
d d


 xrand (t) + r.(x( i − 1) (t) − xi (t))
d
(t) − xid (t)),

+β.(xrand i=2,. . . ,N
(7) random positions, evaluating their fitness at each position.
d
The variable x rand represents a random position within These particles then update their positions and velocities
the search space, where Lbd and Ubd denote the lower and based on historical data, aiming to converge toward the opti-
upper limits, respectively, of the dth dimension. In the MRFO mal position. This process is demonstrated by Equation (9)
algorithm, the chain foraging strategy is employed if the and Equation (10), which illustrate the updating of particle
random value exceeds 0.5. Conversely, if the random value positions and velocities, respectively [47].
is less than or equal to 0.5, the MRFO algorithm utilizes xi,j = xi,j + Vi,j (9)
the cyclone foraging strategy as defined in Equation (3). The
position is then updated to find the best solution according Vi,j = u ∗ Vi,j + c1 ∗ rand1 ∗ (LBi − x( i, j))
to Equation (7), while the somersault strategy, outlined in + c2 ∗ rand2 ∗ (GBi − xi,j ) (10)
Equation (8), is utilized [42]. The inertia weight value often fluctuates during iterations
Xid (t + 1)b = xid (t)b + bs.(r2 .xbest
d
− r3 .xid (t)) within the range of [0, 1]. LBi represents the current best local
solution at iteration number I, while GBi represents the cur-
, i = 1, 2 . . . , N (8)
rent best global solution at iteration number I. The variables
In the MRFO algorithm, the variable S represents the rand1 and rand2 are random numbers within the range of [0,
Somersault factor, while r2 and r3 denote random numbers 1], while c1 and c2 typically denote two constants [47].
within the range of [0, 1] [41]. The value of S is fixed at
2. The somersault feed strategy is characterized by random, 3) PROPOSED MULTI-OBJECTIVE FUNCTION
frequent, localized, and cyclical movements, enabling manta Proposed a new multi-objective function based on the scalar-
rays to maximize their intake of plankton. This strategy ization method that combines the multi-objective into the
involves utilizing the best-known plankton position as a pivot, single solution utilized weights and it was incorporated into
and each swimmer swims back and forth around the pivot the fitness function [48]. The bio-inspired algorithms RMFO
while somersaulting to reach new positions. and PSO seek to combine the three objectives namely: (i) high
The effectiveness of the MRFO algorithm has been accuracy, (ii) smaller false-positive rate, and (iii) a smaller
demonstrated in solving real-world engineering problems. number of subsets features as shown in Equation (11).
It has been evaluated and compared with eight benchmark
algorithms, showcasing superior performance in solving Fitness = W1 ∗ Accuracy − W2 ∗
engineering problems. The MRFO algorithm has also been FPR − W3 ∗ Numfeatures (11)
successfully applied in feature selection for S-shaped and However, the Rank-Sum (RS) weights method is utilized in
V-shaped transfer functions. An evaluation was conducted this paper to calculate weights because it is commonly used.
on 18 UCI datasets, and the MRFO algorithm outperformed Equation (12) can be used to compute RS weights [49].
existing methods in terms of accuracy and the number of
selected features. The results demonstrate the effectiveness of 2(n + 1 − i)
Wi = (12)
the MRFO algorithm compared to state-of-the-art methods in n(n + 1)
terms of accuracy and selected features [40]. where Wi indicates the variable weight value, n indicates the
number of the total weights, and i is the weight number based
2) FEATURE SELECTION BASED PSO on its order in Equation (11) and Table 4 illustrates the value
The PSO algorithm, originally proposed by James Kennedy for each Wight.
and Russell Eberhart in 1995, draws inspiration from the col- The proposed approach combines the MRFO and PSO
lective behavior observed in bird and fish swarms [43], [44]. algorithms to effectively select relevant features from a given
It aims to optimize problems by iteratively refining candidate dataset. Initially, the dataset is divided into separate train-
solutions [45], [46]. PSO operates based on the concept of a ing and testing sets, and a subset of features is generated.
global best solution, which is continually updated during each Subsequently, the bio-inspired algorithm generates candi-
iteration to converge toward the optimal solution. To achieve date feature subsets using a multi-objective function. MRFO
optimal feature selection in BLET, PSO employs a fitness is employed to maximize classification performance while
function that leads to improved feature selection, precision, minimizing the number of selected features, guided by the
and true negative rate. The algorithm initiates particles with proposed multi-objective approach. These candidate feature

VOLUME 11, 2023 98523

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

subsets are then evaluated using a KNN classifier trained

on the transformed training and testing sets. The search for
additional feature subsets continues until a stopping criterion,
based on the desired number of selected features, is met.
Finally, the approach identifies the mutual features shared
by both the MRFO and PSO algorithms to be utilized in the
subsequent abnormality detection stage.

E. ABNORMAL TRANSACTIONS DETECTION

Detecting abnormal transactions plays a crucial role in the
proposed approach, which aims to customize a prediction
model using the selected features from earlier stages. To iden-
tify abnormal transactions within the Ethereum network,
the proposed approach adopts the SGAN algorithm. The FIGURE 4. Flowchart of ATD-SGAN approach.
dataset of abnormal transactions is obtained from donors
through Etherscamdb. It is worth noting that abnormal trans-
actions constitute a small proportion within the Ethereum
Although the BLTE training dataset has 24600 labeled data
network, indicating a high likelihood of encountering unla-
transactions which are 80% of the BLTE dataset, only a small
beled abnormal transactions. Furthermore, in the scenario
fraction of these transactions are used in training and pre-
where a new abnormal behavior emerges, it won’t be auto-
tends that all the remaining transactions are unlabelled. After
matically included in the database for recognizing intrusion
training, testing set 6150 which is 20% of the BLTE dataset
addresses. Semi-supervised learning, by internalizing hidden
related to Table 2 was used to assess the effectiveness of the
patterns within the data, aims to generalize from a lim-
classification model in generalizing the previously unseen
ited set of labeled data points to accurately classify new,
transactions (unlabelled). By using SGAN, the discriminator
unseen examples. The scarcity of labeled datasets poses
becomes a well-trained and robust classifier that may achieve
a significant challenge in both machine-learning research
impressive classification performance from few labeled trans-
and real-world applications. Despite the abundance of unla-
actions as possible, thereby dimensioning the dependency
beled data available (such as images, videos, and text on
of the classification process on a huge volume of labeled
the internet), assigning class labels to them is often cost-
transactions. Moreover, Figure 4 presents the flowchart of the
prohibitive, impractical, and time-consuming. To tackle the
ATD-SGAN approach.
aforementioned challenges, the SGAN algorithm can pro-
vide a solution by automatically assigning accurate labels to
transactions. This is made possible due to the enhanced dis- IV. EXPERIMENT AND RESULTS
criminator present in the SGAN, which offers improvements This section describes the aspects related to the design
over the vanilla GAN approach. methodology and the implementation of the proposed
In SGAN, the discriminator takes a random noise vector z ATD-SGAN approach which is thoroughly explained in
and produces a fake example. On the other side, the discrimi- Section III. ATD-SGAN approach aims to improve the
nator received three types of inputs namely: (i) real labeled abnormality detection in the Ethereum network, in terms
transactions (normal and abnormal transactions resulting of detection accuracy, recall, false alarm rate, and F1-
from BLTE), (ii) real unlabelled transactions (from BLTE measure. Referring to the background of the aforementioned
without label), (iii) fake transactions generated from the gen- bio-inspired feature selection in Section III-C, the MRFO and
erator. Then, the discriminator classifies the unlabelled and PSO algorithm design and evaluation based on the proposed
fake transactions which aims to distinguish fake transactions multi-objective function are presented in this section.
from the real ones, and for real transactions (unlabelled)
identifies the correct class (normal or abnormal). However, A. EVALUATION METRICS
turning the discriminator from being a binary classifier to a In order to assess the effectiveness of an IDS, various eval-
multi-classifier might look like a trivial change (vanilla GAN) uation metrics can be utilized to gauge its performance.
but it implies more significance than it receives at first glance. The performance metrics are calculated using a confusion
As a result, the training of SGAN was conducted in this form matrix derived from the output of the two-class classifier.
to ensure the classification accuracy is close to a supervised The confusion matrix provides detailed information about the
classifier while using labeled and unlabelled transactions. classification outcomes. Each column in the matrix repre-
On the other hand, the generator aims to serve as a source sents a predicted class instance, while each row represents an
of additional information (the fake transactions it produced), actual class instance in the real-world scenario. The equations
which may help the generator learn the relevant pattern in utilized to assess the performance of feature selection are
transactions, improving the classification accuracy. illustrated in Table 5. The symbols used in the equations

98524 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

are as follows: TP represents the count of true positives,

FN represents the count of false negatives, TN represents the
count of true negatives, and FP represents the count of false
positives [50], [51], [52], [53], [54], [55].

B. EXPERIMENTAL SETUP
1) IMPLEMENTATION ENVIRONMENT
The ATD-SGAN is implemented using Python programming
language, which is characterized by its easiness and imple-
mentation robustness, as it is rich in libraries that allow
FIGURE 5. Ensemble feature selection results.
developers to implement machine learning and others easily
from out of the box, friendly syntax, and many researchers
and developers support python and view it as a standard is carefully selected to balance convergence speed and
programming language [56]. In detail, Python version 3.8, stability.
and Spyder Editor version 5.2 for facilitating interactive • Batch Size: A batch size of 32 is used, indicating the
code writing, execution, and result visualization. Moreover, number of events processed in a single update. Larger
Table 6 presents the main libraries used to implement the batch sizes can lead to better hardware utilization and
ATD-SGAN. smoother gradient updates.
The efficient execution of the proposed approach relies • Epochs: The number of training epochs spans a range
on hardware components that offer ample computational from 500 to 8000. This broad range allows for observing
power and memory. This includes a capable multi-core how the model’s performance evolves over extended
processor, Intel Core i7, with a clock speed of at least training periods.
2.0 GHz. Dedicated Graphics Processing Unit (GPU) support
Hyperparameter fine-tuning facilitates the acquisition of pro-
is also essential, with GPUs like the NVIDIA GeForce GTX
found insights into the intricate interactions that exist between
1080 being preferable. Moreover, 32 GB of RAM has been
hyperparameters and their discernible impact on performance
utilized to handle the computational requirements effectively.
outcomes. This discernment holds pivotal importance in the
Additionally, involved a Solid State Drive (SSD) to enhance
interpretation of the obtained results of the model. Besides,
data loading speed and storage efficiency, with a capacity
the comprehensive evaluation of hyperparameters serves as a
of 1 TB.
testament to the depth of assessment undertaken in unraveling
the full potential of ATD-SGAN. Moreover, it serves as an
2) HYPERPARAMETERS OF ATD-SGAN unequivocal demonstration of the model’s adaptability to
Fine-tuning of hyperparameters is a crucial step in achieving varying configurations, effectively enhancing the sphere of
success in ML and DL models [57]. In order to thoroughly intrusion detection.
assess the performance of ATD-SGAN, it is necessary to Furthermore, ATD-SGAN applies MRFO and PSO to both
fine-tune multiple hyperparameters. The evaluation experi- training and test data in order to select a subset of relevant
ments are conducted in phases to evaluate the performance of features. The bio-inspired algorithms generate candidate fea-
the ATD-SGAN approach, utilizing various hyperparameters ture subsets, starting with a random subset of features created
as follows: by a new multi-objective function, as proposed in Equation
• Loss Function: The binary cross-entropy loss function (11). Furthermore, Table 7 shows the parameters of MRFO
is used, serving as the objective function in the neural and PSO used in the experiments of ATD-SGAN.
network. This loss function is well-suited for binary
classification problems, which is the case for abnormal C. RESULTS
transaction detection. 1) ENSEMBLE FEATURE RESULTS
• Activation Function: Sigmoid activation functions are Let D is a BLTE dataset with 22 features D =
applied at each node after the linear combination of {F0 , F1 , F2 , . . . , F22 }, R is the feature subset from D by
inputs. The sigmoid function is commonly used in RMFO algorithm R ⊆ D, and P is the feature subset from
binary classification tasks, as it maps the output to a D by PSO algorithm P ⊆ D. Then, the intersection between
probability-like range between 0 and 1. two sets R and P presents the mutual feature selection, where
• Optimizer: The Adam optimizer is chosen for updating ∀R, P : R ∩ P ≡ {F|F ∈ R3F ∈ P}. Figure5 depicts
the model’s parameters during training. Adam is known the results of ensemble feature selection based on mutual
for its adaptive learning rate and momentum properties, features.
making it efficient for a wide range of optimization Consequently, R = {2, 3, 5, 6, 8, 9, 10, 13, 16, 18, 21},
tasks. P = {0, 1, 2, 3, 5, 6, 14, 15, 16, 17, 18, 20, 21}, and S =
• Learning Rate: The learning rate, set at 10−4 , defines R∩P = 2, 3, 5, 6, 16, 18, 21. In summary, a total of 7 features
the step size taken during parameter updates. This value out of 22 are selected as a result of the mutual feature step.

VOLUME 11, 2023 98525

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

TABLE 5. Evaluation metrics.

TABLE 6. Python l Used to implement the ATD-SGAN. attacks, or abnormal behaviors. However, to demonstrate
the robustness and reliability (in terms of accuracy) of the
ATD-SGAN, it was run with different training epochs (500,
1000, 2000, 3000, 4000, 5000, 6000, 7000, and 8000, respec-
tively). This extensive experimentation aims to capture the
model’s performance across different training durations. The
outcomes reveal an intriguing trend in terms of detection
accuracy, false alarm rate, and F1 measure. As the number
of training epochs increases, there is a progressive improve-
ment in all performance metrics. This observation highlights
the model’s capacity to continuously learn and adapt to
the dataset, resulting in heightened accuracy, reduced false
alarms, and enhanced F1-measure as the training progresses
as shown in Table 9.

3) ENHANCING DETECTION PERFORMANCE

The research contributions, particularly the ensemble feature
selection process and the incorporation of the SGAN model,
TABLE 7. Values of MRFO and PSO control parameters.
are central to the heightened detection performance of the
ATD-SGAN approach. The mutual feature selection step
successfully narrows down the feature set from the original
22 to a compact set of 7 essential features. This parsimo-
nious selection not only improves the model’s efficiency but
also signifies the effectiveness of the multi-objective function
utilized for feature selection. Moreover, the SGAN’s role
in automatic data augmentation equips the model with aug-
mented and diverse data, essential for the training process.
The synergy of these contributions culminates in a highly
According to Table 4.5, the mutual feature selection is Out accurate and robust intrusion detection system. To ensure
degree, Unique in degree, Avg amount incoming, Avg amount a fair and meaningful comparison, all the aforementioned
outcoming, Active Duration, Mean time interval, Avg gas IDSs were assessed using the BLTE dataset. The results
price. Table 8 presents the sample of results. were obtained for each IDS, and the evaluation metrics were
computed accordingly. Table 10, presents the results obtained
2) ATD-SGAN PERFORMANCE ACROSS DIFFERENT EPOCHS from state-of-the-art IDSs and ATD-SGAN using the BLTE
No doubt that detection accuracy is a vital metric for any IDS dataset based on seven subset feature selections S (refer to
since it indicates the robustness of the IDS against intrusions, Section IV-C) and compared to the performance using all

98526 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

TABLE 8. Ensemble bio-inspired feature selection results.

TABLE 9. Values of performance Metrics of ATD-SGAN with different of the evaluation metrics is considered together, of course,
epochs.
the enhancement will be clearly significant. The false alarm
rate is another important evaluation metric that is usually
calculated to indicate the degree of effectiveness of any IDS.
It denotes the ratio in classifying normal transactions wrongly
as abnormal transactions; this means the IDS with the lowest
value of false alarm is the best IDS. However, using the
BLTE dataset, the ATD-SGAN declines the false alarm rate
to LR, SVM, KNN, RF, MLP, LSTM, and CNN, respectively.
Figure 6 (b) presents the enhancement percentages of the
ATD-SGAN with other state-of-the-art IDSs in terms of false
alarms. Besides that, the F1-measure is commonly used to
assess the success of a binary classifier, especially when the
features of the original dataset. Furthermore, the state-of-the- count of one class is less than another, herein since the BLTE
art approaches selected are based on the related works (refer dataset contains binary classes (i.e., two-class instances: (i)
to Section II). normal, and (ii) abnormal transaction), the precision is an
As shown in Table 10, the results ensure the superiority of important metric to be used in evaluating the ATD-SGAN.
ATD-SGAN over the other state-of-art IDSs in terms of the However, Figure 6 (c) shows the enhancement percentages of
average detection accuracy, false alarm rate, and F1-measure, ATD-SGAN with other state-of-the-art IDSs in terms of F1-
as it obtained the highest average detection accuracy (i.e., measure. It can be seen in Figure 6 that the ATD-SGAN also
95.06%) and the highest average f1-measure (95.11%), and the ATD-SGAN enhanced the F1-measure of the compared
lowest false alarm rate (i.e., 8.05%). Overall, the comparison other IDSs approaches.
result revealed that ATD-SGAN detection accuracy on the Substantially, concluded from the above findings, the
previously seen transactions in the testing dataset is far supe- ATD-SGAN is indeed an applicable IDS to address research
rior two comparable with other models trained on the same gaps. In detail, the use of multi-digraph theory to extract
number of labeled transactions. the most important set of features from the generated BLTE
dataset (refer to Section III-B) has increased the overall per-
V. DISCUSSION formance by decreasing the selected number of features used
In the above-mentioned sections, the ATD-SGAN has been to train and test the classifier, then in detecting abnormal
compared with LR, RF, KNN, SVM, MLP, LSMT, and CNN transactions, respectively. Besides, it was discovered that the
in terms of average detection accuracy, false alarm, and F1 proposed multi-objective function (refer to Section III-C),
measure. The obtained comparison results ensure that the which is implicitly achieved in the research objective num-
ATD-SGAN outperformed the other state-of-the-art IDSs in ber two in this paper, has a direct positive effect on the
all evaluation metrics. However, this section provides a dis- feature selection algorithm (i.e., MRFO), and consequently
cussion of enhancement resulting from the ATD-SGAN on on detection process as well. In other words, the use of
the other state-of-the-art IDSs. multi-objectives as a fitness function also ensures the proper
Figure 6 (a) depicts the enhancement percentage of the efficient selection of a set of features. It also assesses the
ATD-SGAN on the other state-of-the-art approaches in terms feature subset if it meets the objectives (i.e., the highest
of the average accuracy in detecting abnormal transactions accuracy and recall and the lowest number of features) or not,
existing in the BLTE dataset across all runs’ experiments. effectively.
However, the enhancement percentages in terms of average Although deep learning is carried out more efficiently than
detection accuracy look slight if they are taken alone with- machine learning, especially when learning a huge volume of
out bearing in mind other metrics used in the evaluation. data, it still suffers from challenges, which might result in data
In fact, if the enhancement percentage resulting from all loss or overfitting problems. The ATD-SGAN proves that it

VOLUME 11, 2023 98527

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

TABLE 10. Comparison results of ATD-SGAN with state-of-the-art approaches.

FIGURE 6. Enhancement percentages of ATD-SGAN with other state-of-the-art IDSs.

overcomes these issues by using the Semi-supervised GAN While feature selection and extraction can be beneficial for
model, which is an unsupervised learning method of DL that deep learning classifiers, it’s important to find the right
automatically generates new augmented data similar to the balance. Removing too many features can lead to a loss
existing one. Also, the ATD-SGAN is not used SGAN only of important information that the classifier needs to make
for generating new data instances, but it is also used to classify accurate predictions. On the other hand, ensemble feature
(detect) unlabelled data (i.e., testing data). However, selecting selection involves using the predictions of multiple models
and extracting the right features can significantly improve to identify the most relevant features for a deep learning
the performance of a deep-learning classifier. Some of the classifier. This method can have several beneficial impacts
ways in which feature selection and extraction can affect a on deep learning classifiers, including:
deep-learning classifier include:
1) Improved accuracy: Combining the predictions of mul-
tiple models can help identify a more robust set of
1) Reducing the dimensionality of the data: By selecting
relevant features, which can improve the accuracy of
the most relevant features and extracting them, you can
the classifier.
help reduce the complexity of the data, which can make
2) Reduced risk of overfitting: By aggregating the predic-
the training process more efficient and reduce the risk
tions of multiple models, ensemble feature selection
of overfitting.
can help prevent the classifier from overfitting to any
2) Improving generalization: Removing irrelevant or
one particular model, resulting in a more generalizable
redundant features can help the classifier learn more
model.
generalizable patterns in the data, improving its perfor-
3) Enhanced interpretability: Ensemble feature selection
mance on unseen data.
can help identify a smaller and more interpretable set
3) Enhancing interpretability: Extracting meaningful fea-
of features, making it easier to understand and interpret
tures from the data can help you better understand and
the classifier’s decisions.
interpret the model’s decisions, which can be partic-
4) Increased efficiency: By selecting a smaller and more
ularly useful in applications where interpretability is
relevant set of features, ensemble feature selection can
important.
make the training process more efficient and reduce the
4) Decreasing computational complexity: Removing
computational complexity of the classifier.
unnecessary features can reduce the number of param-
eters in the model, decreasing the computational Our proposed solution revolves around the utilization of
complexity of training and inference. Semi-Supervised Generative Adversarial Networks for the

98528 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

detection of anomalous transactions within the Ethereum reliance on self-prepared datasets that often lack transparency
network. We believe that the strengths of our approach lie in in terms of attack coverage and accuracy.
several key areas: The implications of our research are manifold. Firstly,
our approach significantly improves detection accuracy by
• Real Dataset Utilization: Unlike many existing leveraging the power of generative adversarial networks
approaches that rely on self-prepared datasets, we employ and semi-supervised learning. Secondly, the utilization of
real-time Ethereum transactions to evaluate the effec- real-time Ethereum transactions establishes the relevance of
tiveness of our IDS. This helps in establishing the our findings in a rapidly evolving and dynamic blockchain
real-world applicability of our method and allows for environment. Moreover, our transparent evaluation approach,
a more accurate assessment of its performance. addressing both strengths and limitations, contributes to the
• Enhanced Detection Accuracy: Our approach seeks to scholarly discourse by fostering transparency and encour-
improve the detection accuracy of anomalous transac- aging further advancements. In terms of insights, our study
tions through the utilization of state-of-the-art genera- underscores the value of embracing real datasets for evalu-
tive adversarial networks. By incorporating both labeled ating blockchain-based security solutions. The complexities
and unlabeled data, our IDS aims to achieve a more of real-world transactions and the presence of varying attack
refined classification, thus reducing false negatives and scenarios challenge us to create more resilient IDSs that can
positives. withstand evolving threats.
• Transparent Evaluation: In our paper, we emphasize Additionally, the insights drawn from our results shed light
transparency in evaluation by thoroughly discussing the on the intricacies of anomaly detection within blockchain
strengths and limitations of our method. We present networks, prompting future researchers to delve deeper into
a comprehensive analysis of our results, including the refining IDSs and their applications. The ATD-SGAN was
areas where our approach excels and where further compared with LR, RF, KNN, SVM, MLP, LSTM, CNN,
refinement is needed. and ATD-SGAN using the BLTE dataset, and it outperformed
• Practical Significance: Our research strives to contribute all of them, as it achieved 95.06%, 8.05%, and 95.11%
to the development of resilient IDSs that can make of average accuracy, average false alarm, and average F1-
tangible improvements in the detection of anomalous measure, respectively. Particularly the ATD-SGAN can be
transactions in the Ethereum network. By addressing the applied to secure the Ethereum network, and other types of
research problem’s core aspects, we aim to bridge the Blockchain networks in general, without being vulnerable
gap between existing methodologies and the practical to abnormal transaction attacks. When this IDS is imple-
requirements of a real-world blockchain environment mented on real Ethereum transactions, these transactions are
efficiently classified into normal or abnormal ones; thus, the
In conclusion, the ATD-SGAN approach proves to be
miner can distinguish whether the transaction is fake or not,
highly effective in securing not only the Ethereum network
and consequently, it will have the ability to figure out the
but also other types of blockchain networks. By successfully
abnormal account. Therefore, a miner can secure its network
detecting abnormal transaction attacks, this IDS ensures the
from attacks and abnormal transactions. The ATD-SGAN
network’s resilience. When implemented on real Ethereum
then satisfies the requirements of achieving high security and
transactions, the ATD-SGAN efficiently classifies them as
efficient self-decision. Despite the successful implementation
normal or abnormal, enabling miners to identify and distin-
of the proposed ATD-SGAN to detect abnormal transac-
guish fake transactions. As a result, the network becomes
tions in the Ethereum network, there is still a margin for
more resistant to attacks and abnormal transactions. The
improvement. The following is a brief list of recommen-
ATD-SGAN meets the criteria for delivering strong secu-
dations that can be improved or provide a basis for future
rity measures and effective decision-making capabilities.
research:
Additionally, this IDS surpasses the state-of-the-art IDSs in
terms of accuracy, recall, false alarm rate, precision, and
• ATD-SGAN has been designed for binary classification
F1-measure, showcasing its exceptional performance across
of Ethereum transactions (normal or abnormal). How-
a range of evaluation metrics.
ever, the ATD-SGAN can be extended to multi-class
anomaly detection problems in the Ethereum network.
VI. CONCLUSION AND FUTURE WORKS • Applying mutual features based on proposed multi-
Throughout this study, we have introduced a new approach, objective function in other network datasets to enhance
called ATD-SGAN, that employs Semi-Supervised Genera- IDS performance wherein feature selection plays a sig-
tive Adversarial Networks to detect anomalous transactions. nificant role in detection performance.
This approach capitalizes on the integration of real-time • ATD-SGAN approach can be extended to detect other
Ethereum transaction data, thereby bridging the gap between intrusion attacks such as phishing, malware, spam, and
existing methodologies and the practical requirements of botnets.
real-world blockchain environments. Our method’s strengths • Design a real-time approach to detecting abnormal trans-
include its utilization of real datasets, which contrasts with the actions in Blockchain networks.

VOLUME 11, 2023 98529

 Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

• Hybridizing the ATD-SGAN with signature-based IDS [19] E. Rabieinejad, A. Yazdinejad, R. M. Parizi, and A. Dehghantanha,
to enhance the overall detection performance. ‘‘Generative adversarial networks for cyber threat hunting in Ethereum
blockchain,’’ Distrib. Ledger Technol., Res. Pract., vol. 2, no. 2, pp. 1–19,
Jun. 2023.
ACKNOWLEDGMENT [20] R. Tan, Q. Tan, P. Zhang, and Z. Li, ‘‘Graph neural network for Ethereum
The authors express their gratitude to the University of Petra fraud detection,’’ in Proc. IEEE Int. Conf. Big Knowl. (ICBK), Dec. 2021,
pp. 78–85.
and the American University of Madaba, Jordan, for admin-
[21] Z. A. El Houda, A. S. Hafid, and L. Khoukhi, ‘‘Cochain-SC: An intra- and
istrative and technical support. inter-domain DDoS mitigation scheme based on blockchain using SDN
and smart contract,’’ IEEE Access, vol. 7, pp. 98893–98907, 2019.
REFERENCES [22] Z. A. El Houda, A. Hafid, and L. Khoukhi, ‘‘Co-IoT: A collaborative DDoS
mitigation scheme in IoT environment based on blockchain using SDN,’’
[1] F. Poursafaei, G. B. Hamad, and Z. Zilic, ‘‘Detecting malicious Ethereum
in Proc. IEEE Global Commun. Conf. (GLOBECOM), Dec. 2019, pp. 1–6.
entities via application of machine learning classification,’’ in Proc. 2nd
Conf. Blockchain Res. Appl. Innov. Netw. Services (BRAINS), Sep. 2020, [23] Z. A. E. Houda, A. Hafid, and L. Khoukhi, ‘‘BrainChain—A machine
pp. 120–127. learning approach for protecting blockchain applications using SDN,’’ in
[2] H. Zhu, W. Niu, X. Liao, X. Zhang, X. Wang, B. Li, and Z. He, ‘‘Attacker Proc. IEEE Int. Conf. Commun. (ICC), Jun. 2020, pp. 1–6.
traceability on Ethereum through graph analysis,’’ Secur. Commun. Netw., [24] S. Al-E’mari, M. Anbar, Y. Sanjalawe, and S. Manickam, ‘‘A labeled
vol. 2022, Jan. 2022, Art. no. 3448950. transactions-based dataset on the Ethereum network,’’ in Proc. Int. Conf.
[3] Q.-B. Nguyen, A.-Q. Nguyen, V.-H. Nguyen, T. Nguyen-Le, and Adv. Cyber Secur. Singapore: Springer, Feb. 2020, pp. 61–79.
K. Nguyen-An, ‘‘Detect abnormal behaviours in Ethereum smart contracts [25] F. Scicchitano, A. Liguori, M. Guarascio, E. Ritacco, and G. Manco,
using attack vectors,’’ in Proc. 6th Int. Conf. Future Data Secur. Eng. Nha ‘‘Blockchain attack discovery via anomaly detection,’’ in Proc. Consiglio
Trang, Vietnam: Springer, Nov. 2019, pp. 485–505. Nazionale Delle Ricerche, Istituto di Calcolo e Reti ad Alte Prestazioni,
[4] R. Brandon. (2016). How an Experimental Cryptocurrency Lost 2019, pp. 1–12.
(and Found) $53 Million. [Online]. Available: https://www.theverge. [26] B. Riyaz and S. Ganapathy, ‘‘A deep learning approach for effective intru-
com/2016/6/17/11965192/ethereum-theft-dao-cryptocurrency-million- sion detection in wireless networks using CNN,’’ Soft Comput., vol. 24,
stolen-bitcoin no. 22, pp. 17265–17278, Nov. 2020.
[5] T. Chen, Z. Li, Y. Zhang, X. Luo, A. Chen, K. Yang, B. Hu, T. Zhu, S. Deng, [27] K. Yoon and S. Kwek, ‘‘A data reduction approach for resolving the
T. Hu, J. Chen, and X. Zhang, ‘‘DataEther: Data exploration framework for imbalanced data issue in functional genomics,’’ Neural Comput. Appl.,
Ethereum,’’ in Proc. IEEE 39th Int. Conf. Distrib. Comput. Syst. (ICDCS), vol. 16, no. 3, pp. 295–306, May 2007.
Jul. 2019, pp. 1369–1380. [28] M. Blachnik and M. Kordos, ‘‘Comparison of instance selection and
[6] J. Frank, C. Aschermann, and T. Holz, ‘‘ETHBMC: A bounded model construction methods with various classifiers,’’ Appl. Sci., vol. 10, no. 11,
checker for smart contracts,’’ in Proc. 29th USENIX Secur. Symp., 2020, p. 3933, Jun. 2020.
pp. 2757–2774.
[29] S. Rao, P. Poojary, J. Somaiya, and P. Mahajan, ‘‘A comparative study
[7] L. Brent, A. Jurisevic, M. Kong, E. Liu, F. Gauthier, V. Gramoli, R. Holz,
between various preprocessing techniques for machine learning,’’ Int.
and B. Scholz, ‘‘Vandal: A scalable security analysis framework for smart
J. Eng. Appl. Sci. Technol., vol. 5, no. 3, pp. 431–438, 2020.
contracts,’’ 2018, arXiv:1809.03981.
[8] D. Canellis. (2019). Hackers Steal $48.7 m in Ethereum From [30] J.-M. Jo, ‘‘Effectiveness of normalization pre-processing of big data to the
South Korean Cryptocurrency Exchange Upbit. [Online]. Available: machine learning performance,’’ J. Korea Inst. Electron. Commun. Sci.,
https://thenextweb.com/hardfork/2019/11/27/ethereum-upbit- vol. 14, no. 3, pp. 547–552, Jan. 2019.
cryptocurrency-exchange-hackers-stolen-million-hot-wallet [31] J. B. Awotunde and S. Misra, ‘‘Feature extraction and artificial
[9] TSMIT. (2020). Hackers May Have Just Stolen $1 Million From the intelligence-based intrusion detection model for a secure Internet of Things
Ethereum Classic Blockchain in a ‘51%’ Attack. MIT Technology Review. networks,’’ in Illumination of Artificial Intelligence in Cybersecurity and
[Online]. Available: https://www.technologyreview.com Forensics. Cham, Switzerland: Springer, 2022, pp. 21–44.
[10] A. H. H. Kabla, M. Anbar, S. Manickam, T. A. Al-Amiedy, P. B. Cruspe, [32] S. Ullah, J. Ahmad, M. A. Khan, E. H. Alkhammash, M. Hadjouni,
A. K. Al-Ani, and S. Karuppayah, ‘‘Applicability of intrusion detection Y. Y. Ghadi, F. Saeed, and N. Pitropakis, ‘‘A new intrusion detection
system on Ethereum attacks: A comprehensive review,’’ IEEE Access, system for the Internet of Things via deep convolutional neural network
vol. 10, pp. 71632–71655, 2022. and feature engineering,’’ Sensors, vol. 22, no. 10, p. 3607, May 2022.
[11] G. Andresini, A. Appice, L. De Rose, and D. Malerba, ‘‘GAN augmenta- [33] S. S. Funai and D. Giataganas, ‘‘Thermodynamics and feature extrac-
tion to deal with imbalance in imaging-based intrusion detection,’’ Future tion by machine learning,’’ Phys. Rev. Res., vol. 2, no. 3, Sep. 2020,
Gener. Comput. Syst., vol. 123, pp. 108–127, Oct. 2021. Art. no. 033415.
[12] J. Lee and K. Park, ‘‘GAN-based imbalanced data intrusion detection [34] D. Guo, J. Dong, and K. Wang, ‘‘Graph structure and statistical properties
system,’’ Pers. Ubiquitous Comput., vol. 25, no. 1, pp. 121–128, Feb. 2021. of Ethereum transaction relationships,’’ Inf. Sci., vol. 492, pp. 58–71,
[13] Y. Sun and L. Gu, ‘‘Attention-based machine learning model for smart Aug. 2019.
contract vulnerability detection,’’ J. Phys., Conf. Ser., vol. 1820, no. 1, [35] D. Lin, J. Wu, Q. Yuan, and Z. Zheng, ‘‘T-EDGE: Temporal weighted
Mar. 2021, Art. no. 012004. multidigraph embedding for Ethereum transaction network analysis,’’
[14] O. Lutz, H. Chen, H. Fereidooni, C. Sendner, A. Dmitrienko, Frontiers Phys., vol. 8, p. 204, Jun. 2020.
A. R. Sadeghi, and F. Koushanfar, ‘‘ESCORT: Ethereum smart COntRacTs
[36] J. Brownlee, ‘‘How to choose a feature selection method for machine
vulnerability detection using deep neural network and transfer learning,’’
learning,’’ Mach. Learn. Mastery, vol. 10, Nov. 2019.
2021, arXiv:2103.12607.
[15] A. Elbaghdadi, S. Mezroui, and A. El Oualkadi, ‘‘K-nearest neighbors [37] S. Chattopadhyay, A. Dey, and H. Basak, ‘‘Optimizing speech emo-
algorithm (KNN): An approach to detect illicit transaction in the Bitcoin tion recognition using Manta-Ray based feature selection,’’ 2020,
network,’’ in Integration Challenges for Analytics, Business Intelligence, arXiv:2009.08909.
and Data Mining. IGI Global, 2021, pp. 161–178. [38] Y. Duan, C. Liu, S. Li, X. Guo, and C. Yang, ‘‘Manta ray foraging
[16] N. Kumar, A. Singh, A. Handa, and S. K. Shukla, ‘‘Detecting malicious and Gaussian mutation-based elephant herding optimization for global
accounts on the Ethereum blockchain with supervised learning,’’ in Proc. optimization,’’ Eng. Comput., vol. 39, no. 2, pp. 1085–1125, Apr. 2023.
4th Int. Symp., Cyber Secur. Cryptogr. Mach. Learn. (CSCML). Sheva, [39] M. G. Hemeida, S. Alkhalaf, A.-A.-A. Mohamed, A. A. Ibrahim, and
Israel: Springer, Jul. 2020, pp. 94–109. T. Senjyu, ‘‘Distributed generators optimization based on multi-objective
[17] R. F. Ibrahim, A. M. Elian, and M. Ababneh, ‘‘Illicit account detection in functions using Manta Rays Foraging Optimization Algorithm (MRFO),’’
the Ethereum blockchain using machine learning,’’ in Proc. Int. Conf. Inf. Energies, vol. 13, no. 15, p. 3847, Jul. 2020.
Technol. (ICIT), Jul. 2021, pp. 488–493. [40] K. K. Ghosh, R. Guha, S. K. Bera, N. Kumar, and R. Sarkar, ‘‘S-shaped
[18] M. Varun, B. Palanisamy, and S. Sural, ‘‘Mitigating frontrunning attacks versus V-shaped transfer functions for binary Manta Ray Foraging Opti-
in Ethereum,’’ in Proc. 4th ACM Int. Symp. Blockchain Secure Crit. Infras- mization in feature selection problem,’’ Neural Comput. Appl., vol. 33,
truct., May 2022, pp. 115–124. pp. 11027–11041, Jan. 2021.

98530 VOLUME 11, 2023

Y. K. Sanjalawe, S. R. Al-E’mari: Abnormal Transactions Detection in the Ethereum Network

[41] W. Zhao, Z. Zhang, and L. Wang, ‘‘Manta ray foraging optimization: [54] Y. Sanjalawe and T. Althobaiti, ‘‘DDoS attack detection in cloud com-
An effective bio-inspired optimizer for engineering applications,’’ Eng. puting based on ensemble feature selection and deep learning,’’ Comput.,
Appl. Artif. Intell., vol. 87, Jan. 2020, Art. no. 103300. Mater. Continua, vol. 75, no. 2, pp. 3571–3588, 2023.
[42] B. Tran, B. Xue, and M. Zhang, ‘‘A new representation in PSO for [55] T. Althobaiti, Y. Sanjalawe, and N. Ramzan, ‘‘Securing cloud computing
discretization-based feature selection,’’ IEEE Trans. Cybern., vol. 48, no. 6, from flash crowd attack using ensemble intrusion detection system,’’ Com-
pp. 1733–1746, Jun. 2018. put. Syst. Sci. Eng., vol. 47, no. 1, pp. 453–469, 2023.
[43] R. A. Ibrahim, A. A. Ewees, D. Oliva, M. Abd Elaziz, and S. Lu, [56] S. Raschka, J. Patterson, and C. Nolet, ‘‘Machine learning in Python: Main
‘‘Improved salp swarm algorithm based on particle swarm optimization for developments and technology trends in data science, machine learning, and
feature selection,’’ J. Ambient Intell. Humanized Comput., vol. 10, no. 8, artificial intelligence,’’ Information, vol. 11, no. 4, p. 193, Apr. 2020.
pp. 3155–3169, Aug. 2019. [57] P. T. Sivaprasad, F. Mai, T. Vogels, M. Jaggi, and F. Fleuret, ‘‘Optimizer
[44] H. B. Nguyen, B. Xue, I. Liu, and M. Zhang, ‘‘Filter based backward benchmarking needs to account for hyperparameter tuning,’’ in Proc. Int.
elimination in wrapper based PSO for feature selection in classification,’’ Conf. Mach. Learn., 2020, pp. 9036–9045.
in Proc. IEEE Congr. Evol. Comput. (CEC), Jul. 2014, pp. 3111–3118.
[45] O. Almomani, ‘‘A feature selection model for network intrusion detection
system based on PSO, GWO, FFA and GA algorithms,’’ Symmetry, vol. 12,
no. 6, p. 1046, Jun. 2020.
YOUSEF K. SANJALAWE received the Ph.D.
[46] D. A. Putri, D. A. Kristiyanti, E. Indrayuni, A. Nurhadi, and D. R. Hadinata,
degree in cloud computing and cybersecurity
‘‘Comparison of naive Bayes algorithm and support vector machine using
PSO feature selection for sentiment analysis on E-Wallet review,’’ J. Phys., from Universiti Sains Malaysia (USM), Penang,
Conf. Ser., vol. 1641, no. 1, Nov. 2020, Art. no. 012085. Malaysia, in 2020. He is currently an Assistant
[47] E.-S. M. El-Kenawy and M. Eid, ‘‘Hybrid gray wolf and particle swarm Professor with the Department of Cybersecu-
optimization for feature selection,’’ Int. J. Innov. Comput. Inf. Control, rity, School of Information Technology, American
vol. 16, no. 3, pp. 831–844, 2020. University of Madaba (AUM). He was a field
[48] Y.-M. Xia, X.-M. Yang, and K.-Q. Zhao, ‘‘A combined scalarization supervisor of Ph.D. students in different fields,
method for multi-objective optimization problems,’’ J. Ind. Manag. Optim., including cybersecurity, cloud computing, the IoT,
vol. 17, no. 5, pp. 2669–2683, 2021. fog computing, optimization, and AI. His main
[49] N. Gunantara, ‘‘A review of multi-objective optimization: Methods and its research interests include AI, cybersecurity, blockchain, optimization, cloud
applications,’’ Cogent Eng., vol. 5, no. 1, Jan. 2018, Art. no. 1502242. computing, and the IoT.
[50] S. Al-E’mari, M. Anbar, Y. Sanjalawe, S. Manickam, and I. Hasbullah,
‘‘Intrusion detection systems using blockchain technology: A review,
issues and challenges,’’ Comput. Syst. Sci. Eng., vol. 40, no. 1, pp. 87–112,
2022. SALAM R. AL-E’MARI received the bachelor’s
[51] Y. Sanajalwe, M. Anbar, and S. Al-E’mari, ‘‘COVID-19 automatic detec-
and master’s degrees in computer science from
tion using deep learning,’’ Comput. Syst. Sci. Eng., vol. 39, no. 1,
Yarmouk University, Jordan, and the Ph.D. degree
pp. 15–35, 2021.
[52] N. Sultana, N. Chilamkurti, W. Peng, and R. Alhadad, ‘‘Survey on
in cybersecurity from Universiti Sains Malaysia
SDN based network intrusion detection system using machine learn- (USM), Penang, Malaysia, in 2022. She is cur-
ing approaches,’’ Peer-Peer Netw. Appl., vol. 12, no. 2, pp. 493–501, rently an Assistant Professor with the Department
Mar. 2019. of Information Security, University of Petra (UoP).
[53] S. Tug, W. Meng, and Y. Wang, ‘‘CBSigIDS: Towards collaborative She has made significant contributions to vari-
blockchained signature-based intrusion detection,’’ in Proc. IEEE Int. ous domains, including blockchain, deep learning,
Conf. Internet Things (iThings) IEEE Green Comput. Commun. (Green- network security, and other computer science
Com) IEEE Cyber, Phys. Social Comput. (CPSCom) IEEE Smart Data disciplines.
(SmartData), Jul. 2018, pp. 1228–1235.

VOLUME 11, 2023 98531