An AI-Driven Blockchain Forensics Framework for Detecting and Tracing Illicit Digital Asset Transactions
Proposed Research Area: Artificial Intelligence • Blockchain Forensics • Cybersecurity • Graph Machine Learning
Important methodological note. The numerical results in this proposal are not presented as results already obtained by the proposed system. Published results are explicitly labeled as literature benchmarks, while the proposed framework's results are stated as expected outcomes/targets to be tested experimentally.
1. Abstract
This research proposes an AI-driven blockchain forensics framework for detecting, tracing, and explaining illicit digital-asset transactions across public blockchain networks. Existing blockchain forensic analysis can exploit transaction graphs, address/entity clustering, temporal behavior, and machine learning, but practical investigation remains difficult because illicit activity is sparse, patterns evolve over time, and laundering may span multiple addresses, services, and chains. The proposed framework will integrate transaction graph construction, heuristic entity clustering, temporal and structural feature engineering, graph neural networks (GNNs), anomaly detection, suspicious-subgraph mining, and bidirectional fund-flow tracing. A risk-scoring layer will combine model predictions with trace evidence, while an explainability layer will expose the paths, graph structures, temporal signals, and model features supporting an alert. The study will first establish reproducible baselines on public datasets such as the Elliptic Bitcoin dataset and Elliptic2, and will then evaluate the framework using precision, recall, F1, PR-AUC, ROC-AUC, Recall@K, tracing accuracy, computational cost, and case-level evidence quality. The objective is not merely to classify transactions as illicit, but to produce an investigator-oriented forensic chain of evidence that connects suspicious activity to transaction paths and candidate entities.
2. Background and Problem Statement
Public blockchains provide transparent transaction records, but transparency does not automatically make criminal activity easy to investigate. Addresses are generally pseudonymous, transaction activity is highly interconnected, and illicit behavior can be distributed across multiple transactions. The Elliptic dataset established a widely used benchmark containing 203,769 Bitcoin transaction nodes, 234,355 directed payment-flow edges, 166 node features, and 49 temporal steps; only 4,545 nodes are labeled illicit, illustrating the severe class imbalance of the task. citeturn1search0turn1academia37
Graph-based learning is particularly relevant because illicit activity is relational rather than purely transactional. The original Elliptic study evaluated Logistic Regression, Random Forest, MLP, and GCN approaches, and reported that Random Forest was strongest in its experimental setting while motivating combinations of conventional machine learning and graph methods. citeturn1academia37turn1search3
More recent work has moved from transaction/node classification toward subgraph-level AML analysis. Elliptic2 contains 122K labeled subgraphs within a background graph of approximately 49M node clusters and 196M transaction edges, explicitly treating laundering patterns as graph structures. citeturn1search35turn1academia36
These developments motivate a framework that joins detection with tracing. Detection alone answers whether activity looks suspicious; forensic tracing must additionally identify how funds moved, which entities are connected, where suspicious flows originated or terminated, and what evidence supports the conclusion.
3. Research Gap
Research gap | Proposed response |
Detection vs. investigation | Many models focus on classification; the proposed work links classification to explicit fund-flow tracing and case evidence. |
Temporal evolution | Illicit behavior changes over time. The framework will evaluate temporal splits and temporal graph representations rather than relying only on random splits. |
Subgraph structure | Laundering often has a structural pattern across multiple transactions. Elliptic2 motivates subgraph-level representations rather than isolated-node decisions. |
Entity ambiguity | Address clustering can introduce false mergers. Recent evaluation shows that the reliability of the multi-input heuristic varies by metric and entity, so clustering confidence will be tracked rather than treated as ground truth. |
Explainability | A high risk score alone is insufficient for forensic use. The framework will return paths, neighborhood evidence, temporal signals, and confidence. |
Cross-chain extension | The architecture will be designed so chain-specific parsers can feed a common graph representation, while cross-chain claims will only be made where explicit bridge/exchange evidence is available. |
4. Aim and Objectives
Aim: To design and experimentally evaluate an explainable AI framework that detects suspicious digital-asset activity and traces the associated transaction flows into investigator-readable forensic evidence.
Construct a temporal transaction-graph representation from public blockchain data.
Develop robust preprocessing and address/entity clustering with uncertainty controls.
Compare classical ML, GNN, temporal GNN, and anomaly-detection approaches for illicit-activity detection.
Detect suspicious subgraphs and characterize structural patterns associated with illicit flows.
Develop forward and backward transaction-path tracing from high-risk nodes.
Generate a composite risk score that combines predictive probability with graph, temporal, and tracing evidence.
Evaluate the framework using reproducible, leakage-resistant experimental protocols.
Produce an investigator-oriented case report containing suspicious entities, paths, timestamps, scores, and explanations.
5. Research Questions
RQ1: How much does graph structure improve illicit transaction detection compared with transaction-only machine-learning baselines?
RQ2: Do temporal graph representations improve robustness to evolving illicit behavior?
RQ3: Can subgraph-level representations improve identification of laundering patterns compared with isolated transaction classification?
RQ4: Can a combined detection-and-tracing pipeline identify meaningful illicit fund-flow paths while controlling false positives?
RQ5: Which evidence components contribute most to an investigator's ability to understand and validate an alert?
6. Proposed Framework
6.1 Data Layer
The initial experimental phase will use public, research-oriented datasets. The Elliptic dataset provides a controlled benchmark for illicit-vs-licit transaction classification. Elliptic2 provides a substantially larger subgraph setting for AML representation learning. Ethereum phishing datasets and published Ethereum graph studies can support a second-chain evaluation where compatible labels and transaction representations are available. citeturn1search0turn1academia36turn0academia21turn0search1
6.2 Graph and Entity Representation
The framework will represent transactions, addresses/entities, and transfers using graph structures appropriate to each chain. Features will include transaction value, input/output counts, temporal position, degree statistics, neighborhood behavior, path length, flow concentration, and other legally and technically permissible blockchain-derived signals. Multiple address-clustering heuristics may be evaluated, but cluster assignments will be treated as uncertain in light of evidence that heuristic reliability can vary substantially across services and evaluation criteria. citeturn0academia22turn0academia23turn0academia20
6.3 AI Detection Layer
Baselines will include Logistic Regression, Random Forest, XGBoost or another tree-based model, and MLP. Graph models will include GCN, GraphSAGE and GAT/GATv2 where computationally feasible. Temporal extensions will be tested using temporal graph representations. Class imbalance will be addressed using class-weighted losses, focal loss, resampling where appropriate, and especially PR-AUC/Recall-oriented evaluation rather than accuracy alone. Prior work on Elliptic reports that focal-loss GCN variants can improve correct prediction of illicit transactions relative to cross-entropy in the studied configurations, while a 2025 IEEE Access study reports gains from Chebyshev and GATv2-style graph convolutions with skip connections. citeturn0search2turn0search4
6.4 Tracing and Forensic Reasoning
For each high-risk transaction/entity, the system will perform bounded forward and backward traversal, identify high-value or high-risk paths, compute path-level features, and summarize connected entities. The goal is to avoid treating every connected address as suspicious; instead, paths will be ranked using risk, temporal consistency, flow value, structural relevance, and evidence quality.
6.5 Explainability and Evidence
Each alert will include: (1) risk score and model confidence, (2) top contributing features or subgraph signals, (3) suspicious transaction/path identifiers, (4) timestamps and flow amounts where available, (5) neighboring entities, (6) clustering confidence, and (7) a concise machine-generated case narrative constrained to observed evidence. The system will distinguish observed blockchain facts from model inferences so that an AI prediction is not presented as proof of criminal conduct.
7. End-to-End Workflow
8. Experimental Design
Component | Planned design | Evaluation |
Datasets | Elliptic; Elliptic2; compatible Ethereum labeled datasets | Dataset statistics, label distribution, temporal coverage |
Splitting | Primary temporal split; supplementary stratified split only for comparability | Leakage checks; time-based generalization |
Baselines | LR, RF, MLP, tree-based model | Precision, Recall, F1, PR-AUC, ROC-AUC |
Graph models | GCN, GraphSAGE, GAT/GATv2 | Same metrics + runtime |
Temporal models | Temporal graph representation/model | Performance by time window |
Tracing | Bidirectional bounded search + path scoring | Path validity, hit@K/Recall@K, tracing precision |
Explainability | Feature/subgraph/path evidence | Evidence completeness and analyst-oriented case review |
Ablation | Remove temporal, graph, clustering, tracing, explainability components | Change in performance and cost |
9. Dataset Summary
Dataset | Scale | Labels / structure | Role in study |
Elliptic Bitcoin | 203,769 nodes; 234,355 edges; 166 features; 49 time steps | 4,545 illicit; 42,019 licit; remaining unknown | Primary node/transaction benchmark |
Elliptic2 | 49M node clusters; 196M edges; 122K labeled subgraphs | Subgraphs associated with illicit activity | Subgraph-level AML evaluation |
Ethereum phishing datasets | Dataset-specific | Phishing / normal labels depending on source | Second-chain validation where compatible |
Sources: Elliptic/Kaggle and published Elliptic/Elliptic2 research. citeturn1search0turn1academia37turn1search35
10. Results: Published Benchmarks vs. Proposed Expected Results
To keep the proposal scientifically honest, the following published findings are not claimed as results of this proposed project. They establish the feasibility and baseline context. The second table contains targets that will be tested, not guaranteed outcomes.
Published study | Verified result | Meaning for this proposal |
Weber et al. (2019), Elliptic | The original study compared LR, RF, MLP and GCN; RF was strongest in its reported experimental setting. | Use conventional ML as a serious baseline rather than assuming GNN always wins. |
GCN + focal loss study (2023) | On Elliptic, focal-loss GCN variants correctly predicted 4.78%, 5.00% and 6.20% more illicit transactions than corresponding cross-entropy versions for 2-, 4- and 6-layer configurations. | Class imbalance and loss design should be explicitly evaluated. |
IEEE Access (2025) | Chebyshev/GATv2 convolutions with skip connections were reported to improve illicit-transaction classification in the studied experiments. | Use modern GNN variants as candidate models. |
Elliptic2 (2024) | 122K labeled subgraphs within a 49M-node-cluster/196M-edge background graph were introduced for subgraph-level AML. | Evaluate subgraph reasoning in addition to node classification. |
Ethereum phishing GNN (2022) | PDGNN was evaluated on five Ethereum datasets and reported improved phishing detection over general phishing-detection methods. | Support second-chain validation where data are compatible. |
Sources: citeturn1academia37turn0search2turn0search4turn1academia36turn0academia21
10.1 Proposed Expected Results / Testable Targets
Outcome | Expected direction | How it will be verified |
Detection | Graph/temporal models are expected to improve PR-AUC and illicit-class recall over transaction-only baselines. | Matched temporal splits + confidence intervals over repeated runs. |
Tracing | Risk-ranked paths are expected to recover more relevant suspicious flows than unranked traversal. | Recall@K / hit@K and manually defined path-validity criteria. |
Robustness | Temporal evaluation is expected to expose and reduce performance degradation on later activity windows. | Train on earlier time steps; test on later time steps. |
Explainability | Evidence-backed alerts are expected to be more useful than score-only alerts. | Structured analyst/case-review rubric. |
Efficiency | A practical model should keep inference and graph search bounded enough for batch or near-real-time investigation. | Latency, memory, and throughput measurements. |
11. Evaluation Metrics
Precision = TP / (TP + FP)
Recall = TP / (TP + FN)
F1 = harmonic mean of precision and recall
PR-AUC = primary ranking metric under strong class imbalance
ROC-AUC = secondary discrimination metric
Recall@K / Hit@K = ability to surface relevant suspicious entities or paths among the top K results
Tracing precision = proportion of returned paths that satisfy predefined forensic validity criteria
Runtime / memory = computational practicality
Calibration error = reliability of predicted risk probabilities
12. Ablation and Error Analysis
The study will systematically remove one component at a time: graph structure, temporal features, clustering, subgraph representation, anomaly detection, and evidence ranking. False positives will be reviewed by activity type, graph degree, transaction volume, and time window. False negatives will be examined for long laundering chains, sparse activity, rapid fund movement, and structurally unusual behavior. This is important because high overall accuracy can be misleading when illicit cases are rare.
13. Ethical, Legal, and Forensic Considerations
The framework is intended for research, compliance, and forensic assistance—not autonomous accusation or automated legal judgment.
Model outputs will be treated as investigative leads, not proof of criminal intent.
Public blockchain data will be used in the benchmark phase; any off-chain identity information will require appropriate legal and ethical authorization.
Address clustering and external attribution will be reported with uncertainty and source provenance.
Reproducibility will be prioritized through documented preprocessing, fixed evaluation protocols, versioned code, and dataset citations.
14. Expected Contributions
A unified architecture connecting illicit-activity detection with transaction-flow tracing.
An experimentally reproducible comparison of classical ML, GNN, temporal, and subgraph approaches.
A risk-scoring mechanism that combines model evidence with graph/path evidence.
An explainable forensic case representation rather than a classification label alone.
An evaluation protocol emphasizing temporal generalization, class imbalance, and clustering uncertainty.
A foundation for later multi-chain extension and investigator-facing tooling.
15. Proposed Timeline
Phase | Activities | Indicative period |
1 | Literature review, threat taxonomy, dataset acquisition | Months 1–2 |
2 | Graph construction, preprocessing, clustering and baselines | Months 3–4 |
3 | GNN/temporal/subgraph models | Months 5–7 |
4 | Tracing, risk scoring and explainability | Months 8–9 |
5 | Evaluation, ablation, error analysis | Months 10–11 |
6 | Writing, reproducibility package and final thesis/paper | Month 12 |
16. References
- Weber, M., Domeniconi, G., Chen, J., Weidele, D. K. I., Bellei, C., Robinson, T., & Leiserson, C. E. (2019). Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 1954–1964. arXiv:1908.02591. citeturn1academia37turn1search3
- Bellei, C., Xu, M., Phillips, R., Robinson, T., Weber, M., Kaler, T., Leiserson, C. E., Arvind, & Chen, J. (2024). The Shape of Money Laundering: Subgraph Representation Learning on the Blockchain with the Elliptic2 Dataset. KDD Workshop on Machine Learning in Finance. arXiv:2404.19109. citeturn1academia36turn1search35
- Li, P., Xie, Y., Xu, X., Zhou, J., & Xuan, Q. (2022). Phishing Fraud Detection on Ethereum using Graph Neural Network. arXiv:2204.08194. citeturn0academia21
- Xi, H., He, K., Lin, S., Yang, J., & Mao, H. (2021). Bitcoin Address Clustering Method Based on Multiple Heuristic Conditions. arXiv:2104.09979. citeturn0academia22
- Schnoering, H., Porthaux, P., & Vazirgiannis, M. (2024). Assessing the Efficacy of Heuristic-Based Address Clustering for Bitcoin. arXiv:2403.00523. citeturn0academia23
- Müller, L., Elsner, J., Niedermayer, T., Haslhofer, B., Goger, T., Kühl, N., & Rückert, C. (2026). How Reliable Is the Multi-Input Heuristic for Bitcoin Address Clustering in Law Enforcement Contexts? arXiv:2607.07414. citeturn0academia20
- IEEE (2023). A Study on GCN using Focal Loss on Class-Imbalanced Bitcoin Transaction for Anti-Money Laundering Detection. iEECON 2023. DOI: 10.1109/iEECON56657.2023.10126580. citeturn0search2
- IEEE Access (2025). Enhancing Anti-Money Laundering Frameworks: An Application of Graph Neural Networks in Cryptocurrency Transaction Classification. IEEE Access 13, 50201–50215. DOI: 10.1109/ACCESS.2025.3552240. citeturn0search4
- IEEE (2022). Graph Analysis of the Ethereum Blockchain Data: A Survey of Datasets, Methods, and Future Work. 2022 IEEE International Conference on Blockchain. DOI: 10.1109/Blockchain55522.2022.00042. citeturn0search1
- IEEE (2024). On-graph Machine Learning-based Fraud Detection in Ethereum Cryptocurrency Transactions. TrustCom 2023. DOI: 10.1109/TrustCom60117.2023.00174. citeturn0search3
- Elliptic. Elliptic Data Set. Kaggle dataset documentation. citeturn1search0
17. Suggested Keywords
Blockchain Forensics; Cryptocurrency Forensics; Digital Asset Transactions; Illicit Transaction Detection; Anti-Money Laundering; Graph Neural Networks; Temporal Graph Learning; Anomaly Detection; Transaction Graphs; Entity Resolution; Fund-Flow Tracing; Explainable AI; Cybersecurity; Financial Crime Analytics.