<![CDATA[The substantial and imbalanced volume of Ethereum transactions presents significant challenges for anomaly detection, especially when labels serve as proxies for execution errors rather than confirmed fraud. An interpretable feature-scenario framework was developed utilizing Logistic Regression, Random Forest, and XGBoost on 4,604,555 unique transactions. The isError attribute was employed as a proxy anomaly label. Data splitting occurred prior to address encoding; encoders were trained exclusively on the training set, unseen wallets were assigned a reserved code, and Random Under Sampling (RUS) was applied solely to training data. Evaluation incorporated both an imbalanced random test set and future-block validation. Among 920,911 random-test transactions (3.59% anomalies), Random Forest, excluding the Hour feature and without resampling, achieved optimal operational performance: 0.8204 precision, 0.6716 recall, 0.7386 F1-score, 0.7820 PR-AUC, 0.7338 MCC, and a 0.0055 false-positive rate. Application of RUS increased recall to 0.9035 but reduced precision to 0.3088, resulting in 69.12% of 96,703 alerts being false positives. Future-block validation further reduced PR-AUC to 0.0177 and MCC to 0.0678, indicating a substantial distribution shift. SHAP identified destination-wallet encoding and BlockHeight as the most influential model features, while LIME provided local, non-causal explanations. The primary contribution is an interpretable feature-scenario and validation framework; however, verified malicious labels and dynamic graph representations are still required for operational deployment.]]>
Copyrights © 2026
