Discovering Persistent Behavioural Patterns for Interpretable Blockchain Forensics

2026-08-13

AI Summary

This study addresses the limitations of existing blockchain behavior analysis methods, which are often confined to specific applications, lack scalability, and offer limited interpretability—hindering long-term, large-scale forensic investigations. To overcome these challenges, this work proposes a scalable, application-agnostic analytical framework that constructs behavioral statements by integrating contract, token, and market context. It models users’ long-term behavioral patterns through sentence-level and sequence-level embeddings and generates interpretable community profiles based on behavioral motifs, routines, and temporal dynamics. Notably, this approach is the first to combine persistent behavioral pattern discovery with explainable analysis, moving beyond conventional snapshot-based methods. Evaluated on 30 million Ethereum transactions, the framework successfully identifies diverse behaviors—including DEX trading, NFT activity, phishing, bot operations, oracle manipulation, and rug-pulls—with most patterns demonstrating stability across time windows.

Abstract

Public blockchain data enables large-scale DeFi-related analysis, but many existing approaches are application-specific, difficult to scale, or hard to interpret. This research proposes a scalable, application-agnostic framework for \emph{persistent behavioural pattern discovery} from large-scale blockchain activity. It constructs behaviour sentences enriched with contract, token and market context, then applies a two-step embedding process: sentence-level embeddings capture individual actions, while sequence-level embeddings capture user behaviour over time. An interpretable behavioural profiler characterizes discovered communities through behavioural motifs, routines, temporal dynamics, entity exposure, and suspiciousness evidence. Evaluation on Ethereum using over 30 million transactions shows that the framework uncovers both routine and malicious behavioural patterns, including decentralised exchange (DEX) trading, NFT activity, phishing, bot operations, oracle manipulation, and rug-pull schemes. Importantly, many patterns remain stable across independent observation windows, enabling the identification of long-term behaviours beyond a single analysis period. The proposed framework combines scalability, interpretability, and persistence analysis, supporting blockchain forensic investigation, behavioural attribution, and threat discovery.

Problem

• blockchain forensics
• behavioural patterns
• interpretability
• persistence
• scalability

Innovation

• persistent behavioural patterns
• interpretable blockchain forensics
• two-step embedding
• behavioural profiler
• scalable framework