International Journal of Computer Network and Information Security (IJCNIS)
IJCNIS Vol. 18, No. 3, 8 Jun. 2026
Cover page and Table of Contents: PDF (size: 1148KB)
Forensically Interpretable Graph Descriptors for Improved Illicit Bitcoin Transaction Detection
PDF (1148KB), PP.63-84
Views: 0 Downloads: 0
Author(s)
Medet Shaizat
1,*
Shynar Mussiraliyeva
1
Ihor Tereikovskyi
2
Index Terms
Cryptocurrency, Bitcoin, Anti-Money Laundering, Illicit Transaction Detection, Forensic Features, Graph Descriptors, Interpretable Machine Learning
Abstract
The Elliptic dataset is widely used in Bitcoin anti-money laundering research, yet its original anonymized features have limited forensic interpretability. Much of the existing Elliptic-based literature relies on these opaque benchmark variables, leaving insufficient attention to semantically explicit and interpretable graph representations for illicit transaction detection. To address this gap, this article proposes a combined approach that integrates transaction-level feature reconstruction with interpretable forensic descriptor engineering. First, the benchmark’s original feature space is replaced with a semantically explicit reconstructed representation derived from public on-chain transaction data and metadata after resolving benchmark node identifiers to transaction hashes. Second, the proposed approach extends this reconstructed representation with interpretable forensic descriptors that capture local transaction abnormality, outgoing value redistribution behavior, and deviations from upstream transaction history. The empirical design isolates the contribution of the proposed descriptors by comparing the reconstructed representation against its descriptor-augmented variant. Across eight classifiers evaluated under a whole-snapshot train-test protocol that preserves within-snapshot graph structure, the descriptor-augmented representation consistently improves illicit class retrieval. CatBoost achieves the best results, increasing the area under the precision recall curve for the illicit transaction class from 85.10% to 90.27%, precision from 77.49% to 87.04%, recall from 75.57% to 81.11%, and F1-score from 76.44% to 83.90%. The article also discusses how the predictive component can be embedded into a hybrid analytical framework that separates machine learning classification from address-level forensic interpretation. This structure supports explainable prioritization and expert review while preserving the distinction between predictive evidence and forensic interpretation. Overall, the findings demonstrate that semantically explicit and forensically interpretable representations can substantially improve illicit transaction retrieval while supporting transparent post hoc analysis in Bitcoin anti-money laundering research.
Cite This Paper
Medet Shaizat, Shynar Mussiraliyeva, Ihor Tereikovskyi, "Forensically Interpretable Graph Descriptors for Improved Illicit Bitcoin Transaction Detection", International Journal of Computer Network and Information Security(IJCNIS), Vol.18, No.3, pp. 63-84, 2026. DOI:10.5815/ijcnis.2026.03.04
Reference
[1]Chainalysis Team, “Crypto Crime Reaches Record High in 2025 as Nation-State Sanctions Evasion Moves On-Chain at Scale,” Chainalysis, Jan. 8, 2026. Available at: https://www.chainalysis.com/blog/2026-crypto-crime-report-introduction/ (accessed Mar. 05, 2026).
[2]Financial Action Task Force (FATF), Virtual Assets: Targeted Update on Implementation of the FATF Standards on VAs and VASPs. Paris: FATF/OECD, 2025. Available at: https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/2025-Targeted-Upate-VA-VASPs.pdf (accessed Mar. 05, 2026).
[3]Chainalysis Team, “Chinese Language Money Laundering Networks Emerge as Major Facilitators of the Illicit Crypto Economy, Now Driving 20% of Laundering Activity,” Chainalysis, Jan. 27, 2026. Available at: https://www.chainalysis.com/blog/2026-crypto-money-laundering/ (accessed Mar. 05, 2026).
[4]M. Weber, G. Domeniconi, J. Chen, D. K. I. Weidele, C. Bellei, T. Robinson, and C. E. Leiserson, “Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics,” arXiv:1908.02591, 2019, doi:10.48550/arXiv.1908.02591.
[5]Blockchair, “Blockchair.com API v.2.0.80 Documentation.” Available at: https://blockchair.com/api/docs (accessed Mar. 01, 2026).
[6]Crystal Intelligence, “Accurate data for blockchain investigation and compliance.” Available at: https://crystalintelligence.com/blockchain-analytics-tool/ (accessed Mar. 01, 2026).
[7]A. B. Turner, S. McCombie, and A. J. Uhlmann, “Analysis Techniques for Illicit Bitcoin Transactions,” Frontiers in Computer Science, vol. 2, Art. no. 600596, pp. 1–12, 2020, doi:10.3389/fcomp.2020.600596.
[8]Y. Elmougy and L. Liu, “Demystifying Fraudulent Transactions and Illicit Nodes in the Bitcoin Network for Financial Forensics,” in Proc. 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD ’23), Long Beach, CA, USA, 2023, pp. 3979–3990, doi:10.1145/3580305.3599803.
[9]J. Song and Y. Gu, “HBTBD: A Heterogeneous Bitcoin Transaction Behavior Dataset for Anti-Money Laundering,” Applied Sciences, vol. 13, no. 15, Art. no. 8766, 2023, doi:10.3390/app13158766.
[10]J. Lorenz, M. I. Silva, D. Aparício, J. T. Ascensão, and P. Bizarro, “Machine Learning Methods to Detect Money Laundering in the Bitcoin Blockchain in the Presence of Label Scarcity,” in Proc. 1st ACM International Conference on AI in Finance (ICAIF ’20), New York, NY, USA: ACM, 2020, Art. no. 23, pp. 1–8, doi:10.1145/3383455.3422549.
[11]I. Alarab, S. Prakoonwit, and M. I. Nacer, “Comparative Analysis Using Supervised Learning Methods for Anti-Money Laundering in Bitcoin,” in Proc. 2020 5th International Conference on Machine Learning Technologies (ICMLT ’20), Beijing, China, 2020, pp. 11–17, doi:10.1145/3409073.3409078.
[12]I. Alarab and S. Prakoonwit, “Graph-Based LSTM for Anti-Money Laundering: Experimenting Temporal Graph Convolutional Network with Bitcoin Data,” Neural Processing Letters, vol. 55, no. 1, pp. 689–707, 2023, doi:10.1007/s11063-022-10904-8.
[13]W. W. Lo, G. K. Kulatilleke, M. Sarhan, S. Layeghy, and M. Portmann, “Inspection-L: Self-Supervised GNN Node Embeddings for Money Laundering Detection in Bitcoin,” Applied Intelligence, vol. 53, no. 16, pp. 19406–19417, 2023, doi:10.1007/s10489-023-04504-9.
[14]A. Mohan, Karthika P. V., P. Sankar, K. Maya Manohar, and A. Peter, “Improving Anti-Money Laundering in Bitcoin Using Evolving Graph Convolutions and Deep Neural Decision Forest,” Data Technologies and Applications, vol. 57, no. 3, pp. 313–329, 2023, doi:10.1108/DTA-06-2021-0167.
[15]J. Nicholls, A. Kuppa, and N.-A. Le-Khac, “FraudLens: Graph Structural Learning for Bitcoin Illicit Activity Identification,” in Proc. 39th Annual Computer Security Applications Conference (ACSAC ’23), Austin, TX, USA, 2023, pp. 324–336, doi:10.1145/3627106.3627200.
[16]T. N. Kipf and M. Welling, “Semi-Supervised Classification with Graph Convolutional Networks,” in Proc. International Conference on Learning Representations (ICLR), 2017, arXiv:1609.02907, doi:10.48550/arXiv.1609.02907.
[17]W. L. Hamilton, R. Ying, and J. Leskovec, “Inductive Representation Learning on Large Graphs,” in Advances in Neural Information Processing Systems, vol. 30, 2017, pp. 1024–1034, doi:10.48550/arXiv.1706.02216.
[18]M. T. Ribeiro, S. Singh, and C. Guestrin, “‘Why Should I Trust You?’ Explaining the Predictions of Any Classifier,” in Proc. 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’16), San Francisco, CA, USA, 2016, pp. 1135–1144, doi:10.1145/2939672.2939778.
[19]S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” in Advances in Neural Information Processing Systems, vol. 30, 2017, pp. 4765–4774, doi:10.5555/3295222.3295230.
[20]D. V. Kute, B. Pradhan, N. Shukla, and A. Alamri, “Deep Learning and Explainable Artificial Intelligence Techniques Applied for Detecting Money Laundering - A Critical Review,” IEEE Access, vol. 9, pp. 82300–82317, 2021, doi:10.1109/ACCESS.2021.3086230.
[21]J. Černevičienė and A. Kabašinskas, “Explainable Artificial Intelligence (XAI) in Finance: A Systematic Literature Review,” Artificial Intelligence Review, vol. 57, Art. no. 216, pp. 1–45, 2024, doi:10.1007/s10462-024-10854-8.
[22]M. Shaizat and S. Mussiraliyeva, “Enhanced Identification of Illicit Bitcoin Transactions Through Genetic Algorithm-Based Feature Selection,” Eastern-European Journal of Enterprise Technologies, vol. 4, no. 9(136), pp. 34–42, 2025, doi:10.15587/1729-4061.2025.335630.
[23]A. Benzik, “Deanonymized 99.5 pct of Elliptic Transactions,” Kaggle Datasets, 2019. Available at: https://www.kaggle.com/datasets/alexbenzik/deanonymized-995-pct-of-elliptic-transactions (accessed Mar. 01, 2026).
[24]S. Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, 2008. Available at: https://bitcoin.org/bitcoin.pdf (accessed Mar. 01, 2026).
[25]S. Meiklejohn, M. Pomarole, G. Jordan, K. Levchenko, D. McCoy, G. M. Voelker, and S. Savage, “A Fistful of Bitcoins: Characterizing Payments Among Men with No Names,” in Proc. 2013 Internet Measurement Conference, 2013, pp. 127–140, doi:10.1145/2504730.2504747.
[26]L. Page, S. Brin, R. Motwani, and T. Winograd, “The PageRank Citation Ranking: Bringing Order to the Web,” Stanford InfoLab Technical Report, no. 1999-66, 1999. Available at: https://ilpubs.stanford.edu/422/1/1999-66.pdf (accessed Mar. 10, 2026).
[27]J. M. Kleinberg, “Authoritative Sources in a Hyperlinked Environment,” Journal of the ACM, vol. 46, no. 5, pp. 604–632, 1999, doi:10.1145/324133.324140.
[28]M. E. J. Newman, “The Structure and Function of Complex Networks,” SIAM Review, vol. 45, no. 2, pp. 167–256, 2003, doi:10.1137/S003614450342480.
[29]S. B. Seidman, “Network Structure and Minimum Degree,” Social Networks, vol. 5, no. 3, pp. 269–287, 1983, doi:10.1016/0378-8733(83)90028-X.
[30][30] P. Bonacich, “Factoring and Weighting Approaches to Status Scores and Clique Identification,” The Journal of Mathematical Sociology, vol. 2, no. 1, pp. 113–120, 1972, doi:10.1080/0022250X.1972.9989806.
[31]C. Leys, C. Ley, O. Klein, P. Bernard, and L. Licata, “Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median,” Journal of Experimental Social Psychology, vol. 49, no. 4, pp. 764–766, 2013, doi:10.1016/j.jesp.2013.03.013.
[32]P. J. Rousseeuw and C. Croux, “Alternatives to the Median Absolute Deviation,” Journal of the American Statistical Association, vol. 88, no. 424, pp. 1273–1283, 1993, doi:10.1080/01621459.1993.10476408.
[33]D. I. Shuman, S. K. Narang, P. Frossard, A. Ortega, and P. Vandergheynst, “The Emerging Field of Signal Processing on Graphs: Extending High-Dimensional Data Analysis to Networks and Other Irregular Domains,” IEEE Signal Processing Magazine, vol. 30, no. 3, pp. 83–98, 2013, doi:10.1109/MSP.2012.2235192.
[34]A. Sandryhaila and J. M. F. Moura, “Discrete Signal Processing on Graphs,” IEEE Transactions on Signal Processing, vol. 61, no. 7, pp. 1644–1656, 2013, doi:10.1109/TSP.2013.2238935.
[35]P. Holme and J. Saramäki, “Temporal Networks,” Physics Reports, vol. 519, no. 3, pp. 97–125, 2012, doi:10.1016/j.physrep.2012.03.001.
[36]A.-L. Barabási, “The Origin of Bursts and Heavy Tails in Human Dynamics,” Nature, vol. 435, pp. 207–211, 2005, doi:10.1038/nature03459.
[37]K.-I. Goh and A.-L. Barabási, “Burstiness and Memory in Complex Systems,” Europhysics Letters, vol. 81, no. 4, Art. no. 48002, 2008, doi:10.1209/0295-5075/81/48002.
[38]A. E. Hoerl and R. W. Kennard, “Ridge Regression: Biased Estimation for Nonorthogonal Problems,” Technometrics, vol. 12, no. 1, pp. 55–67, 1970, doi:10.1080/00401706.1970.10488634.
[39]S. Boyd and L. Vandenberghe, Convex Optimization. Cambridge, U.K.: Cambridge University Press, 2004, doi:10.1017/CBO9780511804441.
[40]Financial Action Task Force (FATF), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers. Paris: FATF/OECD, 2021. Available at: https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Updated-Guidance-VA-VASP.pdf.coredownload.inline.pdf (accessed Mar. 15, 2026).