Graphlet-based Decentralized Finance Transaction Method Classification

Célestin Coquidé; Alessio Brini; Natkamon Tovanich

cs.SIOct 16, 2026

Graphlet-based Decentralized Finance Transaction Method Classification

Authors: Célestin Coquidé, Alessio Brini, Natkamon Tovanich

Organizations: UTINAM Institute, UMR 6213 CNRS, Université Marie et Louis Pasteur, Besançon, France · Duke University, Durham, NC, USA · TU Wien, Vienna, Austria

Abstract

Decentralized Finance (DeFi) transactions involve complex interactions among accounts, smart contracts, and tokens. We investigate whether network topology can identify transaction methods that describe DeFi operations. We extract directed graphlet features to classify the 30 most frequent methods. Our results show that graphlet features complement event log counts in improving classification performance. Using SHapley Additive exPlanations (SHAP), we further derive model explanations that reveal method-specific graphlet structural patterns.

Figures & tables

Features	#	F1-score	Precision	Recall	ROC-AUC	Best model
All graphlets	1,680	0.693	0.790	0.699	0.984	WeightedEnsemble_L2
No graphlet counts	$-$ 40	0.691	0.787	0.697	0.984	WeightedEnsemble_L2
No account types	$-$ 505	0.592	0.727	0.599	0.969	WeightedEnsemble_L2
No token types	$-$ 504	0.669	0.793	0.667	0.981	WeightedEnsemble_L2
No token categories	$-$ 502	0.681	0.748	0.691	0.983	WeightedEnsemble_L2
No token types & categories	$-$ 1,006	0.638	0.746	0.632	0.977	NeuralNetFastAI

Table 1: Classification performance of graphlet-based, event log, and combined feature representations. The # column reports the number of features or, for ablations, the number removed from the complete graphlet-based representation. Best value per metric within each block in bold . The node position count group (129 features) is retained throughout.

Figure 1: Classification results for the top-10 transaction methods: (a) number of transactions per method on the test set, (b) recall-normalized confusion matrix of the combined model, and (c) per-method F1-scores for graphlet-based, event log count, and combined feature models. Panel (a) uses a logarithmic axis. Rows of panel (b) sum to one, so diagonal entries give recall.

Method	GPR (%)	Top 10 most important features
Transfer	67.20	0_Contract (0.25) , Approval (0.09), Swap_4 (0.08), Sync (0.08), Swap_5 (0.06), 0_1_ETH/WETH (0.03) , 1_Contract (0.03) , Deposit_7 (0.03), Permit (0.02), 14_Address (0.02)
Execute	62.28	Permit (0.11), Swap_3 (0.08), 26_Address (0.07) , 1_Contract (0.05) , TransformedERC20 (0.05), OrderRecord (0.04), BridgeFill (0.03), 0_Contract (0.02) , 13_Address (0.02) , 16_Address (0.02)
Swap	58.65	Swap_3 (0.35), 26_Address (0.07) , Permit (0.05), 0_Contract (0.05) , TransformedERC20 (0.03), 1_Contract (0.03) , 16_Address (0.03) , 13_Address (0.02) , ClientData (0.02), 0 (0.02)
Swap Exact ETH For Tokens …	74.99	1_Contract (0.09) , 0_Contract (0.07) , 0_1_Cryptocurrency (0.06) , Deposit_7 (0.06), 0_1_ETH (0.05) , Permit (0.03), 28_Address (0.02) , Swap_4 (0.02), 51_52_erc20 (0.02) , 2_Address (0.02)
Swap Exact Tokens For ETH …	68.61	Swap_4 (0.06), Permit (0.05), Swap_5 (0.05), 0_1_ETH (0.05) , 0_Contract (0.05) , 26_Address (0.04) , 1_Contract (0.04) , TransformedERC20 (0.04), 53_Address (0.03) , Withdrawal (0.03)
Deposit	62.44	0_Contract (0.11) , Deposit_7 (0.10), 1_Contract (0.06) , Swap_5 (0.05), 4_Address (0.05) , Deposit_5 (0.04), LogDeposit (0.04), 14_Address (0.03) , Swap_4 (0.03), Permit (0.03)

Table 2: Top 10 labeled transaction methods with their GPR and 10 most important features by mean absolute SHAP value. Graphlet-based features are shown in bold, with importance values in parentheses. See Section 3.4 for feature naming conventions. Results for all 30 methods are given in Tables A2 and A3 (Appendix C.1 ).

Figure 2: Method-specific graphlet signatures from aggregated SHAP contributions. Rows are methods, columns are directed graphlets. Circle area gives the normalized strength

\tilde{\Pi}_{G,m}^{\mathrm{S}}

and color the normalized direction

\tilde{\Pi}_{G,m}^{\mathrm{D}}

, blue positive and red negative relative to the baseline

\mathcal{B}_{m}

G31

G36

G37

, and

G39

are absent from our data.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 5 — Figure A1: The first 40 graphlets composed of 2 to 4 nodes with labels $G0,\dots,G39$ . For each graphlet, nodes showing the same automorphism have the same color. The 129 orbits with unique automorphism are labelled from 0 to 128. These illustrations are reproduced from Fig. 1 in Sarajlić et al. (2016) . Note that $G31$ , $G36$ , $G37$ and $G39$ are absent from our data.

Figure A2: Recall-normalized confusion matrix for the combined graphlet-based and event-log features. Rows represent actual methods and columns represent predicted methods.

	F1-score			Precision			Recall
Transaction method	Graph.	Events	Comb.	Graph.	Events	Comb.	Graph.	Events	Comb.
Transfer	0.976	0.969	0.982	0.959	0.945	0.971	0.994	0.994	0.993
Execute	0.964	0.927	0.969	0.964	0.892	0.962	0.964	0.965	0.977
Swap	0.986	0.855	0.988	0.987	0.942	0.982	0.985	0.783	0.995
Swap Exact ETH For Tokens Supporting Fee On Transfer Tokens	0.627	0.799	0.855	0.485	0.727	0.819	0.888	0.886	0.894
Swap Exact Tokens For ETH Supporting Fee On Transfer Tokens	0.604	0.929	0.983	0.522	0.955	0.984	0.717	0.905	0.983

Appendix

Table A1: Per-method classification performance for the graphlet-based representation ( Graph. ), the top 1,000 event log count features ( Events ), and their combined representation ( Comb. ). The best result for each method and metric is shown in bold .

Method	$\|\mathcal{T}_{\mathrm{m}}\|$	% graphlet	GPR	Top 10 features (importance)
Transfer	586	99.6	67.2	0_Contract (0.25) , Approval (0.09), Swap_4 (0.08), Sync (0.08), Swap_5 (0.06), 0_1_ETH/WETH (0.03) , 1_Contract (0.03) , Deposit_7 (0.03), Permit (0.02), 14_Address (0.02)
Execute	1000	96.8	62.28	Permit (0.11), Swap_3 (0.08), 26_Address (0.07) , 1_Contract (0.05) , TransformedERC20 (0.05), OrderRecord (0.04), BridgeFill (0.03), 0_Contract (0.02) , 13_Address (0.02) , 16_Address (0.02)
Swap	1000	66.4	58.65	Swap_3 (0.35), 26_Address (0.07) , Permit (0.05), 0_Contract (0.05) , TransformedERC20 (0.03), 1_Contract (0.03) , 16_Address (0.03) , 13_Address (0.02) , ClientData (0.02), 0 (0.02)
Swap Exact ETH For Tokens …	26	100	74.99	1_Contract (0.09) , 0_Contract (0.07) , 0_1_Cryptocurrency (0.06) , Deposit_7 (0.06), 0_1_ETH (0.05) , Permit (0.03), 28_Address (0.02) , Swap_4 (0.02), 51_52_erc20 (0.02) , 2_Address (0.02)
0x0162e2d0	49	4.3	41.64	0x72…499f (0.44), 0x9f…c420 (0.11), 1_Contract (0.06) , Swap_3 (0.03), 4_Address (0.02) , Deposit_7 (0.02), OrderRecord (0.02), 0_Contract (0.02) , Withdrawal (0.02), 26_Address (0.02)
Swap Exact Tokens For ETH …	250	99.9	68.61	Swap_4 (0.06), Permit (0.05), Swap_5 (0.05), 0_1_ETH (0.05) , 0_Contract (0.05) , 26_Address (0.04) , 1_Contract (0.04) , TransformedERC20 (0.04), 53_Address (0.03) , Withdrawal (0.03)

Appendix

Table A2: Top 10 most important features per method by mean absolute SHAP value (graphlet-based features in bold, importance values in parentheses), with the explainability set size

|\mathcal{T}_{\mathrm{m}}|

, the graphlet dominance (% graphlet), and the graphlet participation ratio (GPR, %). Part 1 of 2: first 15 of the 30 methods.

Method	$\|\mathcal{T}_{\mathrm{m}}\|$	% graphlet	GPR	Top 10 features (importance)
Propose Block	9	64.2	54.93	0x98…f0b1 (0.26), Swap_3 (0.05), Permit (0.04), 4_Address (0.03) , 16_Address (0.03) , 69_Contract (0.02) , 0_1_Cryptocurrency (0.02) , Swap_4 (0.02), OrderRecord (0.02), TransformedERC20 (0.02)
Execute F Fs Yo	139	95.1	72.34	7_Address (0.08) , Withdrawal (0.04), 32 (0.03), Swap_3 (0.03), TokenExchange (0.03), Swap_5 (0.03), 0_1_ETH (0.03) , 0_Contract (0.03) , 2_Address (0.03) , Sync (0.02)
Deposit ETH	22	89.9	61.89	Deposit_3 (0.13), 4_Address (0.10) , 0_Contract (0.09) , 0_1_ETH (0.05) , Swap_4 (0.05), ETHBridgeInitiated (0.04), Permit (0.04), 0 (0.03) , TransformedERC20 (0.03), Approval (0.02)
Sigma Buy	50	38.4	39.59	0x24…4e08 (0.43), 0x33…feb3 (0.16), 1_Contract (0.05) , Swap_3 (0.03), 33_Address (0.03) , TransformedERC20 (0.02), 0_1_ETH/WETH (0.02) , 0_1_ETH (0.02) , 0_Contract (0.02) , 25_Address (0.02)
Stake	105	41	43.74	Staked (0.11), 0x22…c42e (0.08), Stake_2 (0.08), Stake_4 (0.07), Staked_2 (0.05), selfStake (0.04), Swap_3 (0.04), 0_Contract (0.04) , 0x7d…7692 (0.03), 0_1_Cryptocurrency (0.03)
Buy With Eth	10	0	33.89	TokensBoughtAndStaked (0.32), TokensBought (0.23), Swap_3 (0.04), 0_1_ETH (0.03) , 1_Contract (0.02) , 5_Address (0.02) , TransformedERC20 (0.02), Permit (0.02), OrderRecord (0.02), 0 (0.02)

Appendix

Table A3: Same as Table A2 . Part 2 of 2: remaining 15 of the 30 methods.

Decentralized Finance

Decentralized finance studies blockchain-based financial services, including lending, trading, liquidity provision, governance, and their security.

See all 30 papers

Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks
Feb 24, 2026Hamideh Khaleghpour, Brett McKinneyFinancial Fraud Detection Temporal Data Leakage
The University of Tulsa, Tulsa, Oklahoma, USA
DeFiRank: Federated Pairwise Ranking for Governance in Decentralized Financial Networks
Oct 9, 2026Zahra Batool, Michael Duchesne, Kaiwen Zhang +1Decentralized Finance Learning to Rank
Ecole de technologie sup´erieure, Montr´eal, Canada · Mila - Quebec AI Institute, Montr´eal, Canada · T-RIZE GROUP, Montr´eal, Canada
DeXposure-FM: A Time-series, Graph Foundation Model for Credit Exposures and Stability on Decentralized Financial Networks
Feb 3, 2026Aijie Shu, Wenbin Wu, Gbenga Ibikunle +1Financial Services Decentralized Finance
School of Informatics, University of Edinburgh, United Kingdom · Cambridge Centre for Alternative Finance, Judge Business School, University of Cambridge, United Kingdom · Business School, University of Edinburgh, United Kingdom +1

Feb 24, 2026J/K move · Enter open · S save

Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks

Hamideh Khaleghpour, Brett McKinney

The University of Tulsa, Tulsa, Oklahoma, USA

Financial Fraud Detection Temporal Data Leakage

Open paper AskPDF arXiv

Illicit transaction detection is often driven by transaction level attributes however, fraudulent behavior may also manifest through network structure such as central hubs, high flow intermediaries, and coordinated neighborhoods. This paper presents a time respecting, leakage safe (causal) graph feature extraction protocol for temporal transaction networks and evaluates its utility for illicit entity classification. Using the Elliptic dataset, we construct directed transaction graphs and compute interpretable structural descriptors, including degree statistics, PageRank, HITS hub or authority scores, k-core indices, and neighborhood reachability measures. To prevent look ahead bias, we additionally compute causal variants of graph features using only edges observed up to each timestep. A Random Forest classifier trained with strict temporal splits achieves strong discrimination on a held out future test period (ROC-AUC about 0.85, Average Precision about 0.54). Although transaction attributes remain the dominant predictive signal, graph derived features provide complementary interpretability and enable risk context analysis for investigation workflows. We further assess operational utility using Precision at k and evaluate probability reliability via calibration curves and Brier scores, showing that calibrated models yield better aligned probabilities for triage. Overall, the results support causal graph feature extraction as a practical and interpretable augmentation for temporal fraud detection pipelines.

Abstract

Decentralized Finance

Explore similar work

Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks

DeFiRank: Federated Pairwise Ranking for Governance in Decentralized Financial Networks

DeXposure-FM: A Time-series, Graph Foundation Model for Credit Exposures and Stability on Decentralized Financial Networks