Towards Efficient and Privacy-Preserving Anomaly Detection of Blockchain-Based Cryptocurrency Transactions

Abstract

In recent years, a growing number of breaches targeting cryptocurrency exchanges have damaged the credibility of the entire cryptocurrency ecosystem. To prevent further harm, it’s crucial to detect the anomalous behaviors hidden within cryptocurrency transactions and offer predictive suggestions. However, details of transaction records must be carefully analyzed for effective detection, and this information could be exploited by adversaries to launch attacks such as de-anonymization and model interference. As a result, it is essential to prioritize privacy preservation when designing an anomaly detection system for cryptocurrency transactions. In this paper, we propose a privacy-preserving anomaly detection (PPad) scheme for cryptocurrency transactions based on a decision tree model, which achieves privacy preservation by using additively homomorphic encryption and matrix perturbation techniques. We also design and implement PPad’s underlying protocol in a cloud outsourcing environment. The correctness and privacy properties of PPad have been proven through detailed analysis. Experimental results show that our scheme can offer privacy assurance with desirable detection effectiveness and efficiency, making it suitable for real-world applications.

A Appendix

In this part, we compare PPad scheme and ADaaS in [17] through theoretical analysis and experiments. From theoretical level, we analyze the detection model, privacy strategies, complexities, and contribution of these two schemes, which are summarized in Table 2. Generally speaking, Paillier operations take more time than VHE operations due to their bit-by-bit nature. However, in the context of this paper, the dimension of a transaction vector is 9, and the number of internal nodes, m, is much smaller than the number of training samples, n (where m is under 100 and n is over 1000). As a result, based on the real parameter settings, PPad scheme is more efficient than ADaaS, a fact which is later confirmed by experimental results.

Table 2. Overall comparison between ADaaS and PPad. (m: number of internal nodes, n: number of training samples, $E_v$: the execution time of one VHE encryption, $\textit{IP}_v$: the execution time of one VHE inner product, $E_p$: the execution time of one Paillier encryption, $D_p$: the execution time of one Paillier decryption.)

The comparative experiments of effectiveness and efficiency are divided into 7 subgroups by varying the size of training dataset from 1000 to 4206, while the number of testing samples is 1803. We set the maximum depth of decision tree in PPad scheme to 5,resulting the value of m ranging from 23 to 35, and we set the modulus number for Paillier to $N=512$. As for ADaaS, we set the nearest neighbour parameter k to 5, with VHE parameters of $m'=11$, $n'=12$. In each subgroup, the effectiveness indicators such as accuracy, precision, recall and F1 score are measured. For assessing the detection efficiency performance, we measure the average detection time for each transaction record, $T_{avg}$.

Table 3. Effectiveness comparison between ADaaS and PPad.

The results presented in Table 3 indicate that our proposed scheme PPad, outperforms ADaaS in terms of effectiveness metrics across almost all subgroups, except for when the training dataset size is 3500, where ADaaS exhibits slightly higher recall. Regarding detection efficiency, as shown in Fig. 6, both schemes have similar trends where the average detection time $T_{avg}$ increases with the size of the training dataset. However, the increase in $T_{avg}$ for ADaaS is more rapid than that of PPad. In general, PPad requires significantly less time to detect a newly-created transaction in each subgroup. Therefore, it can be concluded that our proposed scheme PPad offers a more practical solution than ADaaS as it achieves better detection effectiveness and efficiency.

Fig. 6.

Efficiency comparison between PPad and ADaaS