3.1 Graph Construction

In the process of constructing the transaction graph for analysis, several pivotal decisions and pre-processing steps were taken:

The graph representation should be extended to tensor form to facilitate efficient computation in the GNN model. For instance, the node feature matrix X∈ℝ|V|×d and the edge weight vector W∈ℝ|E| can be encapsulated within a higher-order tensor T∈ℝ|V|×|V|×d, where each element Ti, j, :

Represents the feature vector of the node i if there is an edge from node i to node j, weighted by the edge weight wij.

This tensorial representation is particularly beneficial when extending the model to include multiple types of relations or temporal dynamics where a third dimension could represent time steps or different relation types between nodes.

3.2 Centrality Metrics

We employed the following: In-Degree Centrality, Out-Degree Centrality, and Betweenness Centrality. These metrics are the most relevant for a directed graph and our use case.

where V is the set of nodes, and E is the set of edges in the graph.

where σst is the total number of shortest paths from node s to node t and σst(v) is the number of those paths passing through node v.

3.3 GNN Model Architecture

Velickovic et al. introduced Graph Attention Networks (GATs), which are innovative convolutional neural networks tailored for graph-structured data, utilizing masked self-attentional layers. These graph attentional layers are designed to be computationally efficient, avoiding expensive matrix operations and enabling parallelization across all graph nodes. This efficiency facilitates the implicit assignment of varying importances to nodes within a neighborhood, regardless of the neighborhood’s size, and circumvents the need for complete graph structure knowledge beforehand.

Such capabilities address several theoretical limitations of prior spectral-based methods. Furthermore, models incorporating these attention mechanisms have demonstrated superior or comparable performance to state-of-the-art results in four well-known node classification benchmarks, encompassing both transductive and inductive tasks, and including scenarios with entirely unseen graphs during testing [⁴].

The GAT includes an attention mechanism that dynamically assigns significance to the features of neighboring nodes, which enhances the model’s capacity to discern relevant transactional patterns, as show in Equation 5:

The softmax function is applied across all neighbors j of node i to ensure the comparability of the coefficients. The inclusion of the LeakyReLU nonlinearity, defined as:

where x is the input and α is a small constant, serves multiple purposes. Primarily, it prevents the occurrence of ’dead neurons’ by allowing a small, non-zero gradient when the unit is inactive (x≤0), thus mitigating the dying ReLU problem.

This characteristic is crucial for maintaining gradient flow during backpropagation, especially in the computation of attention scores eij, which are sensitive to the sign of their input.

Furthermore, the LeakyReLU ensures that the attention mechanism remains responsive to both positive and negative inputs, enriching the model’s ability to differentiate between various transactional relationships. Softmax normalization, defined as:

Applies to the attention coefficients, transforming them into a distribution over the neighbors of each node. This process not only makes the attention coefficients αij across different nodes’ neighborhoods comparable but also accentuates the model’s focus on the most relevant features by amplifying the differences among attention scores. Consequently, GATs can prioritize information from neighbors deemed most pertinent for the classification task at hand.

3.4 Model Training

The training and evaluation methodology entails a structured sequence designed to optimize the model’s performance on classifying Bitcoin transactions. The process unfolds as follows:

where yi denotes the true labels, and pi represents the predicted probabilities for the nodes in the training set.

where y^j is the predicted label, yj is the true label, and 1 is the indicator function.

Additionally, the integration of the Optuna framework for hyperparameter optimization plays a pivotal role in fine-tuning the GAT model’s configuration.

This process involves defining a search space for key parameters, such as the number of hidden units, dropout rate, learning rate, and weight decay, and iteratively evaluating the model’s performance across a range of trials to identify the optimal parameter set.

The objective function, centered around maximizing the accuracy on a validation subset, guides the selection of hyperparameters

that contribute to the model’s generalizability and effectiveness.

4.1 Centrality Metrics

The tables below enumerate the top three nodes according to each centrality metric. The focus on the top three nodes is due to their significantly higher centrality values, indicating a dominant role in the network’s transaction dynamics. Specifically, Figure 2 incorporates the top 100 nodes based on In-Degree centrality to produce a coherent and manageable graph visualization.

Fig. 1 Counts of distinct label values 

Fig. 2 Subgraph visualization of top nodes by in-degree centrality 

This approach avoids over-saturation of the visual representation, which is a standard practice in graph theory when dealing with large and interconnected networks.

4.2 Model Performance

The model’s training was conducted using hyperparameters optimized via Optuna, resulting in the following configuration: 64 hidden units, a dropout rate of 0.1478, a learning rate of 0.0835, and a weight decay of 0.000156. The outcomes after training for 500 epochs are encapsulated in the images shown in Figures 3, 4, and 5.

Fig. 3 Training loss and test accuracy 

Fig. 4 Precision, recall, and F1 score 

Fig. 5 Average maximum probability over epochs 

These metrics are visualized in mentioned Figures, which depicts the training loss and test accuracy (3), precision, recall, and F1 score (4), and the average maximum probability over epochs on (5). Each graph represents the progression of the respective metrics over the training period.

4.3 Ten-year Benchmark

This section illustrates a decade-long analysis of the Bitcoin transaction network through various graphical representations. Each figure is detailed below to guide interpretation without drawing any conclusions. Figure 6 displays three key metrics: the number of nodes and edges within the Bitcoin network over the years, and the average value of transactions per year.

Fig. 6 Evolution of the Bitcoin network size and average transaction values from 2013 to 2022 

The lines indicate the growth or decline of these metrics, with scales provided on the left and right y-axes respectively. Figure 7 tracks three network characteristics: average degree, average path length, and density of the network each year. These lines represent the connectivity, efficiency, and compactness of the network respectively, with detailed yearly metrics shown on the graph.

Fig. 7 Network metrics highlighting changes in average degree, path length, and density from 2013 to 2022 

Figure 8 presents the annual performance metrics—precision, recall, and F1 score—of the GAT model when applied to the Bitcoin transaction networks from 2013 to 2022. The graph plots each metric’s progression over the years, providing a visual representation of the model’s performance trends.

Fig. 8 Performance metrics of the GAT model applied to yearly Bitcoin transaction networks 

The decision to limit the graph construction to data from the year 2022 can be substantiated, and the results better understood, by an analytical study of the network’s evolution over the past decade. The supporting evidence lies within the structural dynamics of the Bitcoin network, as revealed through a detailed analysis of network size and metrics.

The performance of our Graph Attention Network (GAT) model, as detailed in Table 7, offers insightful comparisons with both traditional ML models and advanced GNNs, reflecting its capabilities within graph-based representations of Bitcoin transactions. Our model’s architecture and operational framework have been intentionally simplified and focused on a single year of data.

This design choice contrasts with other GNNs that may utilize more complex or multi-year datasets. Despite its straightforward structure, our model achieves a high recall of 0.9287 and an F1-score of 0.9017, demonstrating effective transaction detection capabilities. This performance is particularly notable given the model’s streamlined nature, which not only facilitates understanding and implementation but also enhances the replicability of our research.

The high recall indicates that our model effectively minimizes false negatives—critical for applications requiring stringent security measures such as financial transaction monitoring. Although the precision of 0.8935 does not surpass all other GNN models, it remains competitive, especially when considering the model’s reduced complexity and narrower data scope.

Moreover, the consistent high average maximum probability across training epochs reinforces the reliability of the model’s outputs. This metric, crucial in a softmax output framework, confirms that the model’s predictions are statistically robust, not merely the result of overfitting or underfitting.

Our approach prioritizes transparency and ease of replication, from the comprehensive ETL process to the clear delineation of the modeling steps. This not only supports the scientific validity of our findings but also provides a template for future research, encouraging other scholars and practitioners to replicate and extend our work. The model’s adaptability, coupled with its robust performance, offers significant insights into the potential for using simplified GNN models in complex transaction networks.

4.4 Temporal Scope

The decision to limit the graph construction to data from the year 2022 can be substantiated, and the results better understood, by an analytical study of the network’s evolution over the past decade. The supporting evidence lies within the structural dynamics of the Bitcoin network, as revealed through a detailed analysis of network size and metrics. A descending trend in the number of nodes and edges over the years was observed (Figure 6), with the 2022 graph exhibiting a smaller yet more value-concentrated network.

This trend indicates a move towards higher transaction values being processed through a reduced number of addresses, resulting in a denser and more interconnected network structure. The 2022 network demonstrates an increase in average degree and network density (Figure 7), indicating a more interconnected graph structure with nodes having more direct connections on average.

This increased degree of interconnectivity within a smaller network aligns with the observed enhancement in model performance metrics, suggesting that the more recent and concentrated network structure provides a potent ground for the application of GAT. The optimized model performance in the 2022 network is further corroborated by the re-training of the model using all previous yearly graphs and plotting precision, recall, and F1 score metrics. These metrics collectively suggest that the GAT model is particularly well-suited to a network that has evolved to be more transactionally value-dense and concentrated in influence.

The distilled analysis leads to a better explanation for the selection and results of the 2022 graph as the foundation for the GAT model application within this study. The pronounced concentration of transactional value and connectivity in the latest graph provides an enriched dataset that likely contributes to the improved performance of the classification model.

Future research may delve into the implications of these evolving network characteristics, particularly examining the impact of increasing concentration on the efficacy of transaction pattern analysis tools and their utility in monitoring and regulating digital currency flows.