# Detecting Malicious Accounts showing Adversarial Behavior in Permissionless
Blockchains

Rachit Agarwal
IIT-Kanpur Tanmay Thapliyal
IIT-Kanpur Sandeep K Shukla
IIT-Kanpur

###### Abstract

Different types of malicious activities have been flagged in multiple
permissionless blockchains such as bitcoin, Ethereum etc. While some malicious
activities exploit vulnerabilities in the infrastructure of the blockchain,
some target its users through social engineering techniques. To address these
problems, we aim at automatically flagging blockchain accounts that originate
such malicious exploitation of accounts of other participants. To that end, we
identify a robust supervised machine learning (ML) algorithm that is resistant
to any bias induced by an over representation of certain malicious activity in
the available dataset, as well as is robust against adversarial attacks. We
find that most of the malicious activities reported thus far, for example, in
Ethereum blockchain ecosystem, behaves statistically similar. Further, the
previously used ML algorithms for identifying malicious accounts show bias
towards a particular malicious activity which is over-represented. In the
sequel, we identify that Neural Networks (NN) holds up the best in the face of
such bias inducing dataset at the same time being robust against certain
adversarial attacks.

##  1 Introduction

Blockchains can be modeled as ever-growing temporal graphs, where interactions
(also called as transactions) happen between different entities. In a
blockchain, various transactions are grouped to form a block. These blocks are
then connected together to form a blockchain. A typical blockchain is
immutable and is characterized by properties such as confidentiality,
anonymity, and non-repudiability. Irrespective of the type of blockchain
(which are explained next), these properties achieve a certain level of
privacy and security. There are mainly two types of blockchains -
permissionless and permissioned blockchains. In permissioned blockchains, all
actions on the blockchain are authenticated and authorized, while in
permissionless blockchains such aspects are not required for successful
transactions. Permissionless blockchains usually also support a native crypto-
currency.

Lots of malicious activities, such as ransomware payments in crypto-currency
and Ponzi schemes [4], happen due to the misuse of the permissionless
blockchain platform. A malicious activity is where accounts perform illegal
activities such as Phishing, Scamming and Gambling. In [3], the authors survey
different types of attacks and group them based on the vulnerabilities they
target in the permissionless blockchain. Thus, one question we ask is can we
train a machine learning algorithm (ML) to detect malicious activity and
generate alerts for other accounts to safeguard them? There are various state-
of-the-art approaches, such as [1, 19, 31], that use ML algorithms to detect
malicious accounts in various permissionless blockchains such as Ethereum [6]
and Bitcoin [18]. In [1], the authors outline an approach to detect malicious
accounts where they consider the temporal aspects inherent in a permissionless
blockchain including the transaction based features that were used in other
related works such as [19, 31].

Nonetheless, these related works have various drawbacks. They only study
whether an account in the blockchain is malicious or not. They do not classify
or comment upon the type of malicious activity (such as Phishing or Scamming)
the accounts are involved in. Further, as they do not consider the type of
malicious activities, they do not study the bias induced by the imbalance in
the number of accounts associated with particular malicious activities and,
thus, fail to detect differences in the performance of the identified
algorithm on the different kinds of malicious activities. Additionally, they
do not study the performance of the identified algorithm when any adversarial
input is provided. An adversarial input is defined as an intelligently crafted
account whose features hide the malicious characteristics that an ML algorithm
uses to detect malicious accounts. Such accounts may be designed to evade ML
based detection of their maliciousness.

Thus, we are motivated to answer: (Q1) can we effectively detect malicious
accounts that are represented in minority in the blockchain? Also, we consider
another question and answer: (Q2) can we effectively detect malicious accounts
that show behavior adversarial yp ML based detection? We answer these two
questions using a three-fold methodology. (R1) First, we analyze the
similarity between different types of malicious activities that are currently
known to exist. Here we understand if under-represented malicious activities
do have any similarity with other malicious activities. (R2) We then study the
effect of bias induced in the ML algorithm, if any, by the malicious accounts
attributed to a particular malicious activity which is represented in large
number. We then identify the ML algorithm which we can use to efficiently
detect not only the largely represented malicious activities on the
blockchain, but also activities that are under-represented. For the state-of-
the-art approaches, we train and test different ML algorithms on the dataset
and compute the recall considering all malicious activities under one class.
Next, to understand the robustness of the identified ML algorithm, we test it
on the malicious accounts that are newly tagged with a motivation to
understand, if in future, such accounts can be captured. (R3) Nonetheless, we
also test the robustness of the ML algorithm on the adversarial inputs. Here,
we use Generative Adversarial Networks (GAN) [13] to first generate
adversarial data using already known feature vectors of malicious accounts and
then perform tests on such data using the identified ML model to study the
effect of adversarial attacks.

To facilitate our work, we focus on a permissionless blockchain called
Ethereum blockchain [6]. Ethereum has mainly two types of accounts -
Externally Owned Accounts (EOA) and Smart Contracts (SC) - where transactions
involving EOAs are recorded in the ledger while transactions between SCs are
not. There are various vulnerabilities in Ethereum [8] that attackers exploit
to siphon off the Ethers (a crypto-currency used by Ethereum). Our study is
not exhaustive for all possible attacks in a blockchain. However, we study
only those for which we have example accounts. Note that our work is
applicable to other permissionless blockchains as well that focus on
transactions of crypto-currency. We choose Ethereum because of the volume,
velocity, variety, and veracity within the transaction data. Currently,
Ethereum has more than 14 different types of known fraudulent activities.

Our results show that certain malicious activities behave similarly when
expressed in terms of feature vectors that leverage temporal behavior of the
blockchain. We also observe that Neural Network (NN) performs relatively
better than other supervised ML algorithms and the volume of accounts
attributed to a particular malicious activity does not induce a bias in the
results of NN, contrary to other supervised ML algorithms. Moreover, when an
adversarial data is encountered, NN’s performance is still better than the
other supervised ML algorithms. Henceforth, note that when we refer to the
performance of an ML algorithm we mean recall achieved on a testing dataset.

In summary, our contributions, in this paper are as follows:

  1. 1.

The similarity scores reveal that there exists similarity between different
types of malicious activities present until 7th Dec 2019 in the Ethereum
blockchain and they can be clustered in mostly 3 clusters.

  2. 2.

All the state-of-the-art ML algorithms used in the related studies are biased
towards the dominant malicious activity, i.e., ‘Phishing’ in our case.

  3. 3.

We identify that a Neural Network based ML model is the least affected by the
imbalance in the numbers of different types of the malicious activities.
Further, when adversarial input of the transactional data in the Ethereum
blockchain is provided as test data, NN model is resistant to it. When NN is
trained on some adversarial inputs, its balanced accuracy increases by 1.5%.
When trained with adversarial data, most other algorithms also regain their
performance with RandomForest leading having the best recall.

The rest of the paper is organized as follows. In section 2, we present the
background and the state-of-the-art techniques used to detect malicious
accounts in blockchains. In sections 3, we present a detailed description of
our methodology. This is followed by an in-depth evaluation along with the
results in section 4. We finally conclude in section 5 providing details on
prospective future work.

##  2 Background and Related Work

Between 2011 and 2019 there have been more than 65 exploit incidents on
various blockchains [3]. These attacks mainly exploit the vulnerabilities that
are present in the consensus mechanism, client, network, and mining pools. For
example, Sybil attack, Denial of Service attack, and the 51% attack. In
specific cases such as Ethereum, SC based vulnerabilities are also exploited.
For instance, the Decentralized Autonomous Organization (DAO)
attack111Understanding dao hack: https://www.coindesk.com/understanding-dao-
hack-journalists, exploits the Reentrancy bug [22] present in the SC of the
DAO system. While some of the attacks exploit bugs and vulnerabilities, some
exploits target users of the blockchain. The users are sometimes not well-
versed with the technical aspects of the blockchain while sometimes they get
easily influenced by the various social engineering attempts. Such exploits
are also present in permissionless blockchains such as Ethereum. From the
social engineering perspective, Phishing is the most common malicious activity
present in Ethereum, where it is represented by more than 3000 accounts [12].
The Table 1 presents different known malicious activities that are reported to
exist in the Ethereum blockchain and are used by us in this work. Note that
some activities have similar description but are marked differently in
Ethereum.

Malicious Incident/Activity | Description
---|---
Lendf.Me Protocol Hack | Exploit of a reentrancy vulnerability arising due to usage of ERC-777 token [20].
EtherDelta Website Spoof | Attackers spoofed the official EtherDelta website so that users transact through it [23].
Ponzi Scheme | An attacker enticed a user to lend him crypto-currency, which the attacker
used to repay the debt of previously scammed user.
Parity Bug | Bug in a multi-sig parity wallet which caused freezing of assets.
Phishing | When attackers pose as legitimate to lure individuals into transacting
with them, example Bancor Hack [21].
Gambling | Accounts involved in Gambling activities which is illegal in many countries.
Plus Token Scam | A Ponzi scheme [5].
Compromised | Accounts whose address were either compromised or were scammed.
Scamming | Accounts which are reported to be involved in frauds.
Cryptopia Hack | No official description, but unauthorized and unnoticed transfer happened from
Cryptopia wallet to other exchanges [14].
Bitpoint hack | “Irregular withdrawal from Bitpoint exchange’s hot wallet” [30].
Fake Initial Coin Offerings | Fake Startups aimed to siphon off crowd-funded investments.
Upbit Hack | Speculation that an insider carried out malicious activity when the exchange was
moving funds from hot to cold wallet [15].
Heist | Account involved in various Hacks such as Bitpoint Hack.
Spam Token | No official description on the activity.
Suspicious | No official description but account are mainly involved in various scams.
Scam | No official description but account are mainly involved in various scams.
Unsafe | No official description but account are mainly involved in various scams.
Bugs | Accounts whose associated activities caused issues in the system
Table 1: Malicious Activities on Ethereum blockchain as reported by Etherscan.

Variety of techniques and approaches have been used to detect, study and
mitigate such different types of attacks and vulnerabilities in blockchains.
In [8], authors survey different vulnerabilities and attacks in Ethereum
blockchain and provide a discussion on different defenses employed. We
classify these defenses into 3 groups: (a) those that deploy honeypots to
capture and analyse transactions in the blockchain, (b) those that use wide
variety of machine learning algorithms to analyse transactions, and (c) those
that study the vulnerabilities in the system such as bytecode of the smart
contracts to analyse malicious activities.

In [9], the authors deployed a honeypot and studied the attacks that happen in
the Ethereum blockchain. They analyzed the HTTP and Remote Procedure Call
(RPC) requests made to the honeypot and performed behavioral analysis of the
transactions. They found adversaries follow specific patterns to steal crypto-
currency from the blockchain. Nonetheless, in some instances such honeypots
are also compromised, for example the honeypot at the address -
‘0x2f30ff3428d62748a1d993f2cc6c9b55df40b4d7’.

In [1], the authors present a survey of different state-of-the-art ML
algorithms that are used to detect malicious accounts in a blockchain
transaction network and then presented the need for the temporal aspects
present in blockchains as new features. Here, we refrain ourselves from
surveying again the methods already presented in [1]. Instead, we present
their findings and new techniques that have been reported since. In [1], the
authors categorized the features into two main categories: transaction based
and graph based. With respect to the transaction based features, they reported
the use of features such as Balance In, Balance Out, and Active Duration. With
respect to the graph based features, they identified the extensive use of the
features such as clustering coefficient [26] and in/out-degree. The authors,
motivated to capture the diversity in the transactions, found that the use of
temporal features further enhanced the robustness of the ML algorithm used
towards identifying malicious accounts in a blockchain. These features
amounted to a total of 59 features and were related to inter-event transaction
properties such as the stability of neighborhood (referred to as
attractiveness) and non-uniformity (referred to as burst [16]) present in the
degree, inter-event time, gas-price, and balance. A complete list of feature
used in [1] is presented in appendix B. Using such enriched feature vector,
they validated their approach and achieved high recall ($>78\%$) on the entire
class of malicious accounts present in their test dataset.

In [2], the authors used Graph Convolutional Networks (GCN) to detect money-
laundering related malicious activities in the Bitcoin blockchain. They
developed a Bitcoin transaction graph where the transactions were represented
as the nodes while the flow of Bitcoin (crypto-currency used in Bitcoin
blockchain) was represented as the edges. They used transaction based features
such as amount of Bitcoins received and spent by an account and the Bitcoin
fee incurred by a transaction. Using GCN, they achieved F1 score of 0.77 on
their dataset. Similarly, in [17], the authors constructed a transaction graph
with similar features as in [2] to detect malicious activities in the Bitcoin
blockchain. They compared the use of unsupervised, supervised and active
learning approaches. They observe that the Active Learning techniques
performed better.

In [27] the authors explored the transactions carried out by different
accounts that were involved in Phishing activity. They analyzed the
transaction data and proposed trans2vec, a network embedding algorithm, to
extract features from the Ethereum blockchain data. They, then, used the
extracted features with One Class Support Vector Machine (OC-SVM) to detect
accounts involved in phishing activities, and achieved a recall score of 89.3%
on the malicious class. Although, they focused on the phishing activities,
they did not discuss the applicability of trans2vec with respect to other
types of malicious activities.

In [29], the authors developed a framework to analyze the transactions on the
Ethereum blockchain and detect various attacks which exploit different
vulnerabilities therein. They replayed all transactions related to a
particular address and monitor the Ethereum Virtual Machine (EVM) state. They,
then, applied logic rules on the transactions to detect abnormal behavior
associated with a particular vulnerability and study only Suicidal,
UncheckedCall, and Reentrancy vulnerabilities.

In all the above-mentioned work, the authors did not distinguish between the
behaviors of different types of malicious activities that are present in
permissionless blockchains. Further, no discussion is provided on the effect
of adversarial data on the approaches. To the best of our knowledge, in the
field of blockchain security, the current work is the first instance that
studies data poisoning and evasion and tries to safeguard them against any
adversarial attack.

As adversarial data might not be present in the dataset, GAN [13] is one of
the most commonly used techniques to generate adversarial data for testing the
approach. Based on Neural Network, GANs were originally proposed for usage in
the field of computer vision and machine translation, but over the years the
technique has gained popularity in various sub-domains of cyber-security such
as intrusion detection systems [7]. The architecture of GAN consists of two
basic components: a generator and a discriminator. A generator generates fake
data that has similar characteristics as the original data. The fake generated
data along with the real data is passed to the discriminator which
discriminates the input data and identifies if it is real or fake. Both the
generator and the discriminator are trained iteratively over the dataset. Over
time, generator becomes more intelligent, making it hard for the discriminator
to correctly classify the real and the fake data. There are many variants of
GANs that are available222Different GAN algorithms:
https://github.com/hindupuravinash/the-gan-zoo. We do not describe all the
techniques and variants of GAN as this is out of the scope of this work.
However, here, we only describe CTGan [28] that we use to generate fake data
for every malicious activity represented by accounts in our dataset. Our
choice of CTGan is based on the fact that CTGan is able to generate tabular
data. In CTGan, the generator and discriminator models contain 2 fully
connected hidden layers, which account for capturing correlation in the
feature vectors given to them. They use Rectified Linear Units (ReLU)
activation function along with batch normalization in generator model to
reduce over-fitting. ReLU is defined as the positive part of the argument
passed to activate the neuron. The discriminator has leaky ReLU activation
along with dropout regularization [25] implemented in each hidden layer. When
using CTGan for data generation, for the best results, the authors recommend
the number of epochs (where one epoch represents single iteration over the
dataset) to be greater than 300. One limitation of CTGan is that the generator
model needs at least 10 feature vectors to generate adversarial data.

##  3 Our Approach

In this section, we describe our three-fold approach towards answering our
research questions, in detail.

###  3.1 Computing similarity amongst malicious accounts

We compute cosine similarity measure amongst accounts attributed to different
known malicious activities to understand if the malicious activities have
similar behavior. We acknowledge that there are other methods to quantify
similarity, but in this work we use cosine similarity as it is widely adopted.
As the accounts are associated with a specific type of malicious activity,
besides computing the individual similarity, we compute and analyse pairwise
cosine similarity among the accounts associated with malicious activities.
Assume a dataset $D_{a}$ of malicious and benign accounts in a permissionless
blockchain. We assume that each account is attributed to one and only one
malicious activity. In reality, an account can have multiple associations.
Consider, two malicious activities, $M_{1}$ and $M_{2}$ from a set of
malicious activities $M$ that have set of accounts $A_{M_{1}}$ and $A_{M_{2}}$
associated with them, respectively. We compute cosine similarity ($CS_{i,j}$)
such that $i\in A_{M_{1}}$, $j\in A_{M_{2}}$ and $A_{M_{1}}\bigcap
A_{M_{2}}=\emptyset$ and then identify the probability of it being more than
or equal to 0 ($p(CS_{i,j}\geq 0)$). If for all $i$ and $j$, $CS_{i,j}\geq 0$
then we say that the two malicious activities, $M_{1}$ and $M_{2}$, are
similar.

Then, we use clustering algorithm with the motivation that accounts which are
associated with the same malicious activity would cluster together and show
homophily [10]. We use K-Means algorithm to validate if indeed similarity
exists between thee two malicious activities. Here, we assume an upper limit
on $k$ (hyperparameter for K-Means) and use $k=||M||+1$. Note that $||M||$
represents the size of the set of different malicious activities, i.e., the
number of different activities under consideration and $+1$ part represents
the benign cluster. However, our results show that most of the accounts, even
if they are associated with different malicious activities, cluster together.
Note that in terms of the number of clusters found, the best case scenario
would have been malicious accounts associated with different malicious
activities cluster separately and the worst case would be all malicious
accounts, irrespective of their associated malicious activity, cluster
together.

###  3.2 Bias Analysis

The distribution of the number of accounts associated with each $M_{i}\in M$
is not uniform. This increases the sensitivity of the ML algorithm towards the
$M_{i}\in M$ that is more prominent, i.e., has more number of associated
accounts. Thereby, they induce a bias in the selected model towards $M_{i}$
that has the most number of associated accounts. To understand the effect of
the number of malicious accounts attributed to a particular $M_{i}$ on the ML
algorithm, we segment $D_{a}$ into different training and testing sub-datasets
and use them to train and test ML algorithms. Let the set of different
training and testing sub-datasets be $C=\\{C_{0},$ $C_{1},\cdots,$ $C_{n}\\}$
where each element $C_{i}$ represent a specific split of $D_{a}$. Let
$Tr^{C_{i}}$ denote the training dataset, which contains 80% of randomly
selected accounts from $C_{i}$ and $Ts^{C_{i}}$ denote the test dataset, which
contains the remaining 20% accounts. The different $C_{i}$’s we use are:

  * •

Null model or $C_{0}$: This is our baseline sub-dataset. Here we do not
distinguish between the types of malicious activities rather only consider if
an account is malicious or not. Note that here based on above notations, the
training dataset is represented as $Tr^{C_{0}}$ and the testing dataset as
$Ts^{C_{0}}$.

Let ${A}_{M_{1}}^{S_{0}}$ represent the set of accounts associated with
$M_{1}$ type malicious activity in the testing dataset, $Ts^{C_{0}}$. As our
aim here is to analyze the bias caused due to a malicious activity, for
example $M_{1}$, we analyse the results obtained when training and testing the
ML algorithm using different combinations of accounts associated with $M_{1}$
activity. For instance, we analyse the performance of an ML algorithm when
accounts associated with $M_{1}$ are not present in training dataset but are
present the testing dataset. Below we list all such combinations that we use:

  * •

$C_{1}$: Here we train on $Tr^{C_{0}}$ but test on $Ts^{C_{1}}$ where
$Ts^{C_{1}}=Ts^{C_{0}}-{A}_{M_{1}}^{S_{0}}$, i.e., we train on the 80% of the
dataset, but we remove all the accounts associated with activity $M_{1}$ from
the testing dataset. Ideally, in this case, ML algorithm should perform
similar to $C_{0}$ since the training dataset is same.

  * •

$C_{2}$: Here, we train on $Tr^{C_{2}}=Tr^{C_{0}}-{A}_{M_{1}}^{S_{0}}$ but
test on $Ts^{C_{2}}$ which is same as $Ts^{C_{0}}$, i.e., we remove all the
accounts associated with activity $M_{1}$ from the training dataset, but we
keep the accounts associated with $M_{1}$ in the testing dataset. Ideally, in
this case, ML algorithm should misclassify accounts associated to $M_{1}$ that
are present in $Ts^{C_{2}}$. In case adverse results are obtained, it would
mean that there is a bias.

  * •

$C_{3}$: Here, we train on $Tr^{C_{2}}$ and test on $Ts^{C_{3}}$ which is same
as $Ts^{C_{1}}$, i.e., we remove all the accounts associated with activity
$M_{1}$ from both the training and the testing dataset. Ideally, in this case,
ML algorithm should perform similar to $C_{0}$ since no accounts associated
with $M_{1}$ activity are present in $Tr^{C_{2}}$ and $Ts^{C_{3}}$. In case
adverse results are obtained, it would mean that there is a bias.

  * •

$C_{4}$: Here, we train on $Tr^{C_{4}}=Tr^{C_{0}}+{A}_{M_{1}}^{S_{0}}$ and
test on $Ts^{C_{4}}$ which is same as $Ts^{C_{1}}$, i.e., we remove all the
accounts associated with activity $M_{1}$ from the testing dataset and add
them to the training dataset. Ideally, in this case, ML algorithm should
perform similar to $C_{1}$ since no accounts associated with $M_{1}$ activity
are present in $Ts^{C_{4}}$.

Note that the above four configurations do test different, yet all, scenarios
that are required to understand the effect of a malicious activity, $M_{1}$,
on the ML algorithm. For the sake of completeness, we also consider the
following training and testing sub-datasets:

  * •

$C_{5}$: Here, we perform a 80-20 split of the number of accounts associated
to each malicious activity in $M$. We then collect all these 80% data-splits
along with 80% benign accounts to create the training dataset, $Tr^{C_{5}}$.
Similarly, we collect all the remaining 20% splits to create the testing
dataset, $Ts^{C_{5}}$. We then train on the resulting $80\%$ of the dataset
and test on the remaining $20\%$ of the dataset. Ideally, in this case, ML
algorithm should perform similar to $C_{0}$.

Among the supervised ML algorithms, in [1], the authors presented that the
ExtraTrees Classifier (ETC) performs the best on the data they had. We use ETC
with the identified hyperparameters on the above-mentioned sub-datasets to
identify the bias induced by a malicious activity. Further, as mentioned
before, it is possible that a classifier trained on ETC might fail to capture
new or adversarial data. Thus, we also apply different supervised ML
algorithms on $C_{0}$ and identify the algorithm that achieves the best recall
on the entire malicious class. We then execute the best identified ML
algorithm on the above mentioned sub-datasets. To test the performance of
different supervised ML algorithms on any new data, we collect the new and
more recent malicious accounts transaction data ($D_{b}$) and execute the
identified algorithms on the new transaction data.

###  3.3 Adversarial Analysis

The new collected data ($D_{b}$) shows a low similarity with existing
malicious activities. Such data does not classify as adversarial. We use CTGan
[28] to generate adversarial data for the malicious activities and use this
new adversarial data ($D_{g}$) to validate our findings. Here, we use $D_{g}$
only on the test dataset, i.e., we perform training on $Tr^{C_{0}}$ while we
perform our tests on $Ts^{D_{g}}$ that includes $D_{g}$ and all the benign
accounts in $Ts^{C_{0}}$. Further, we also perform tests after training
different ML algorithms when 1%, 5%, and 80% of such adversarial feature
vectors are added to the training dataset.

Figure 1: Overview of our Methodology used towards R1. Figure 2: Overview of
our Methodology used towards R2. Figure 3: Overview of our Methodology used
towards R3.

In summary, Table 2 provides a list of notations we use. Here, note that we
first generate the feature vector dataset using the same approach as listed by
the authors in [1]. Then, towards methodology one (R1), we compute the cosine
similarity amongst the malicious accounts in $D_{a}$ to understand how similar
they are. We also apply unsupervised ML algorithms such as K-Means on the
malicious accounts in $D_{a}$ to identify if malicious accounts cluster
together (see Figure 1). Towards methodology two (R2), we divide $D_{a}$ into
different training and testing sub-datasets, $C=\\{C_{0},$ $C_{1},\cdots,$
$C_{5}\\}$, and execute different supervised ML algorithms to understand bias
induced by a particular malicious activity and identify the performance of the
reported classifier on the transaction data made available until 27th May 2020
(see Figure 2). Towards methodology three (R3), we first filter out all the
malicious accounts from $D_{a}$ and use CTGan separately on each malicious
activity to generate adversarial ($D_{g}$) data for all the activities where
we have more than 10 accounts. Note that there are two ways using which we can
generate adversarial data: (1) using feature vectors of malicious accounts and
(2) using features vectors of benign accounts. These represent, (1) evading ML
algorithm from being detected as malicious, and (2) evading ML algorithms from
being detected as benign and getting classified as malicious. In this work, we
generate adversarial data using malicious accounts. Further, for CTGan, we use
default parameters to synthesize the data, and use 1000 epochs (an epoch
represents one iteration over the dataset) for fitting. We then compare the
performance of various state-of-the-art supervised ML algorithms on $D_{g}$
(see Figure 3).

Notation | Meaning
---|---
$D_{a}$ | Dataset
$M$ | Set of malicious activities present in $D_{a}$
$M_{i}$ | An element in $M$
$A_{M_{i}}$ | Set of accounts in $D_{a}$ associated with $M_{i}$
$CS_{i,j}$ | Cosine similarity between accounts $i$
and $j$
$p(CS_{i,j}\geq 0)$ | probability of $CS_{i,j}$ to be $>0$
$k$ | Hyperparameter of K-Means algorithm
$C$ | Set of sub-datasets of $D_{a}$
$C_{i}$ | an element in $C$
$Tr^{C_{i}}$ | Training dataset created from $C_{i}$
$Ts^{C_{i}}$ | Testing dataset created from $C_{i}$
$A_{M_{1}}^{S_{1}}$ | Set of accounts associated with $M_{1}$ and
in $Ts^{C_{1}}$
$D_{b}$ | New malicious accounts dataset
$D_{g}$ | Adversarial dataset
$Ts^{D_{g}}$ | Testing dataset created from $D_{g}$ and
benign accounts in $Ts^{C_{1}}$.
$F$ | Feature Vector
Table 2: List of Notations used in our work.

##  4 Evaluation

In this section, we first present the data we use and then provide a detailed
analysis of our results.

###  4.1 Data Used

We use external transactions data present in the Ethereum main-net blockchain.
Ethereum [6] is one of the most widely adopted permissionless blockchain
platform. It uses Proof-of-Work (PoW) consensus mechanism to validate
transactions of the users. Ethereum provides users with the functionality to
deploy additional programs called smart contracts which can be used to control
the flow of the Ethers. In Ethereum, EOAs are accounts/wallet which is owned
by a real-entity or a person; wherein the hash of public key of the owner of
an EOA is the address of the EOA. On the other hand, SCs are similar to EOAs,
with the exception that they contain code to automate certain tasks, such as
sending and receiving Ethers, invoking, creating, and destroying other smart
contracts when needed. SCs can be created and invoked both by EOAs and by
other SCs. There are two types of transactions which occur on the Ethereum
blockchain, External and Internal Transactions. While the external
transactions occur between different EOAs and between EOAs and SCs, they are
recorded on the blockchain ledger. Internal transactions are created by and
occur between different SCs and are not recorded on the blockchain ledger.
Further, SCs can execute external calls which are then recorded on the
blockchain ledger. An external transaction typically has information about
blockHash (hash of the block in which the transaction is present), blockNumber
(another identifier to represent the block in which the transaction is
present), the account from which the transaction is invoked, the account to
which the transfer was made, gas (the amount ‘account present in the from
field of transaction’ is willing to pay to the miners to include the
transaction in the block), gasPrice (cost per unit gas), Transaction hash
(hash of the transaction), balance (Ethers transferred), and the timestamp of
the block. Such transaction are then grouped together into blocks before being
published onto the blockchain.

We use Etherscan API [11] to get transaction data of $2946$ malicious accounts
that were marked until 7th December 2019. As the number of benign accounts
were more than $117$ Million account, we perform under-sampling to get
external transactions of $680,314$ benign accounts. Note that these 680,314
benign accounts and 2946 malicious accounts collectively constitute our
dataset $D_{a}$ (defined in section 3). Since using a similar approach in [1],
the authors obtained good results on similar dataset by including the temporal
features, we use the same set of $59$ features ($F$) in our work, as well. In
short, these $59$ features are based on and can be classified under: (a)
temporal graph based features that includes indegree, outdegree,
attractiveness, inter-event time burst, degree burst, and clustering
coefficient, and (b) transaction based features that includes activeness,
crypto-currency balance and fee paid.

Etherscan provides for each malicious account a caution warning message so
that other accounts can exercise caution while transacting with them. Other
than such warning message, Etherscan also provides information about what
malicious activity the account is involved in. These activities are: Phishing
($2590$ accounts), Scamming ($168$ accounts), Compromised ($21$ accounts),
Upbit Hack ($123$ accounts), Heist ($13$ accounts), Gambling ($8$ accounts),
Spam Token ($10$ accounts), Suspicious ($4$ accounts), Cryptopia Hack ($3$
accounts), EtherDelta Hack ($1$ accounts), Scam ($1$ accounts), Fake ICO ($2$
accounts), Unsafe ($1$ accounts), and Bugs ($2$ accounts). Thus, in the
dataset, there are in total $14$ different types of malicious activities. For
our different training and testing sub-datasets, we currently only focus on
“Phishing” as it is the most prominent malicious activity in our dataset.
Further, note that all the ‘Bitpoint Hack’ accounts were also tagged under
‘Heist’. Therefore, we only use ‘Heist’. In $D_{a}$, we observe that $101$
unique EOAs created $153$ different malicious SCs. These EOAs are not marked
as malicious in the dataset. Most of the EOAs created only one malicious SC,
while, one EOA created $15$ malicious SCs. There are only $3$ SCs that are
created by $3$ different SCs which in turn were created by the $2$ different
EOAs. However, we refrain from adding these accounts in our analysis so as to
not change any ground truth. We do not reveal the identities of these accounts
because we do not want to malign any future transactions.

As this list is dynamic, between 8th December 2019 and 27th May 2020, there
were 1249 more accounts that were identified as malicious by Etherscan. On
top, 487 accounts out of 2946 previously identified malicious accounts
continued to transact until 27th May 2020. These total 1736 malicious accounts
constitute our dataset $D_{b}$ (defined in section 3). The accounts in $D_{b}$
are associated with: Upbit Hack ($691$ accounts), Parity ($131$ accounts),
Phishing ($842$ accounts), Ponzi ($38$ accounts), Gambling ($28$ accounts),
Compromised ($1$ accounts), Unknown ($2$ accounts), Lendf.Me Hack ($2$
accounts), Plus Token Scam ($1$ accounts), Heist ($1$ accounts). We again
notice that, in this case also, some accounts have more than 1 label
associated with them. Based on our assumption, to ease our process, we
associate these accounts with only one type of malicious activity. When
analyzing $D_{b}$, we remove from $Tr^{C_{0}}$ all those accounts that were
common in $D_{a}$ and $D_{b}$ and moved them to $Ts^{C_{0}}$, and retrained
the different supervised ML algorithms to identify their performance.

###  4.2 Results

All our results are averaged over 50 iterations on our dataset and are
generated using Python3.

Figure 4: Cosine similarity between malicious accounts.

####  4.2.1 R1: Similarity Analysis

Some of the malicious activities present in the dataset have similar
definition. We calculate cosine similarity score between all the malicious
accounts present in $D_{a}$ to identify similarity that exists between them
(see Figure 4). From the figure, we observe that in many cases $CS_{i,j}<0$,
as expected because they potentially belong to different malicious activities.
Nonetheless, we also observe that some pair of accounts have high similarity
between them. There are two reasons for such high similarity: (1) these
accounts could actually belong to the same malicious activity, and (2)
although, the account might represent same malicious activity, in Ethereum,
they might be marked differently, i.e., these accounts have been marked for
malicious activities that have similar description. To understand this
further, we check all the accounts associated with a pair of malicious
activities and mark the two activities as similar if all the accounts in one
type of malicious activity have cosine similarity more than 0 with all the
malicious accounts in the other type. Figure 5 depicts the probabilities
$p(CS_{i,j}<0)$ (see Figure 5a) and $p(CS_{i,j}\geq 0)$ (see Figure 5b)
between all the accounts related to two malicious activities. Note that the
two figures are complementary to each other as $p(CS_{i,j}<0)=1-p(CS_{i,j}\geq
0)$. From the figures, we notice that many activities show high probability of
similarity with other malicious activities, for example, ‘Bugs’ and ‘Unsafe’.
There are $\approx$ 158 pairs of malicious activities where $p(CS_{i,j}\geq
0)>0.5$. Further, we also notice that within ‘Phishing’, although most account
are similar, there are some accounts which show dissimilarity.

We use K-Means algorithm to analyze the clustering patterns of all malicious
accounts present in the dataset $D_{a}$ to further understand if the accounts
identified as similar show homophily. Here, we use $k=15$. We see that most of
the malicious accounts, irrespective of the malicious activity they belong to,
cluster together in at most 3 clusters except for the accounts that belong to
malicious activities ‘Heist’, ‘Compromised’, and ‘Gambling’ (see Table 3).
Further, in the cluster that had most number of the malicious accounts (i.e.,
cluster #1), except for accounts associated with ‘Upbit Hack’ and ‘Spam
Token’, all other malicious accounts clustered together in cluster #1.

Therefore, we infer that different malicious activities in a blockchain such
as Ethereum, behave in a similar manner. Same labels could be used to depict
certain malicious activities, such as ‘Phishing’ and ‘Fake ICO’. Currently, we
do not need 14 different labels as most of the malicious activities could be
captured in at most 3 clusters.

Tag Name | Total |  Cluster 1 |  Cluster 2 |  Cluster 3
---|---|---|---|---
Phishing | 2590 | 1700 | 492 | 398
Upbit Hack$\dagger$ | 123 | 32 | 1 | 90
Scamming | 168 | 116 | 27 | 25
Heist$\ddagger$ | 13 | 9 | 1 | 2
Compromised$\ddagger$ | 21 | 17 | - | 1
Unsafe | 1 | 1 | - | -
Spam Token$\dagger$ | 10 | 1 | 3 | 6
Bugs | 2 | 2 | - | -
EtherDelta Hack | 1 | - | 1 | -
Cryptopia Hack | 3 | 2 | - | 1
Gambling$\ddagger$ | 8 | 7 | - | -
Suspicious | 4 | 3 | - | 1
Fake ICO | 2 | 2 | - | -
Scam | 1 | 1 | - | -

  * $\dagger$

not well clustered in cluster 1, $\ddagger$ not well clustered in 3 clusters

Table 3: Clustering of malicious account using K-Means. Here clusters are
ranked based on the number of malicious accounts they cluster.

(a) $p(CS_{i,j}<0)$

(b) $p(CS_{i,j}\geq 0)$

Figure 5: Probability that accounts associated with two malicious activities
show similarity more than 0 or less than 0.

####  4.2.2 R2: Bias Analysis

|  | ETC | NN
---|---|---|---
Data |  | Recall | Recall
Until | sub-datasets | Mal | Ben | Mal | Ben
07/12/2019 | $C_{0}$ | 0.70 | 0.99 | 0.83 | 0.94
$C_{1}$ | 0.76 | 0.99 | 0.86 | 0.89
$C_{2}$ | 0.28 | 0.99 | 0.79 | 0.93
$C_{3}$ | 0.59 | 0.99 | 0.83 | 0.97
$C_{4}$ | 0.79 | 0.99 | 0.87 | 0.90
$C_{5}$ | 0.70 | 0.99 | 0.88 | 0.91

  * ETC

ExtraTreesClassifier(class_weight = ‘balanced’, criterion = ‘entropy’,
max_features = 0.3, max_samples = 0.3, min_samples_leaf = 14,
min_samples_split = 20, n_estimators = 200)

  * NN

NeuralNetworks(epochs = 50, regularization = l2(0.0001), dropout =
0.5,loss=‘binary crossentropy’, optimizer=‘adam’ )

Table 4: Recall achieved using ExtraTrees Classifier and Neural Network for
different sub-dataset. Here ‘Mal’ represents malicious class and ‘Ben’
represents the benign class.

We first test ETC, as [1] reported it to produce the best results, on
different training and testing sub-datasets ($C_{i}$) to understand the bias
induced due to the imbalance in the number of accounts associated with a
particular malicious activity. For ETC, we use the hyperparameters reported by
[1]. These are: class_weight = ‘balanced’, criterion = ‘entropy’, max_features
= 0.3, max_samples = 0.3, min_samples_leaf = 14, min_samples_split = 20,
n_estimators = 200. All other hyperparameters are kept as default. In our
dataset, since most number of malicious accounts are associated with
‘Phishing’ activity, here we choose ‘Phishing’ for our study and our training
and testing sub-datasets are configured accordingly. Note that this analysis
is also valid for other malicious activities. From Table 4, we observe that,
for $C_{2}$ and $C_{3}$, the recall on the accounts tagged as malicious
deteriorates significantly. For $C_{2}$, we expected such results because
there are no ‘Phishing’ accounts in the training dataset ($Tr^{C_{2}}$), but
are present in test dataset ($Ts^{C_{0}}$). However, for $C_{3}$, the recall
on the malicious accounts was below expectation. This proves the existence of
bias in ETC towards ‘Phishing’. To understand further and know which all
malicious activities are impacted due to such bias, we study the confusion
matrix and the distribution of malicious accounts therein.

| Total | ETC | NN
---|---|---|---
Activity |  $Ts^{C_{0}}$.. | $Ts^{C_{5}}$ | $Ts^{C_{0}}$ | $Ts^{C_{1}}$ | $Ts^{C_{2}}$ | $Ts^{C_{3}}$ | $Ts^{C_{4}}$ | $Ts^{C_{5}}$ | $Ts^{C_{0}}$ | $Ts^{C_{1}}$ | $Ts^{C_{2}}$ | $Ts^{C_{3}}$ | $Ts^{C_{4}}$ | $Ts^{C_{5}}$
$..Ts^{C_{4}}$
Phishing | 517 | 508 | 359 | - | 123 | - | - | 352 | 432 | - | 404 | - | - | 442
Upbit | 18 | 25 | 17 | 17 | 17 | 17 | 17 | 25 | 17 | 18 | 17 | 17 | 18 | 25
Scamming | 33 | 34 | 22 | 23 | 15$\dagger$ | 15$\dagger$ | 23 | 23 | 26 | 27 | 24$\ddagger$ | 24$\ddagger$ | 27 | 28
Heist | 1 | 3 | 0 | 0 | 0 | 0 | 0 | 1 | 1 | 1 | 1 | 1 | 1 | 2
Compro.. | 5 | 5 | 5 | 5 | 4 | 4 | 5 | 4 | 2 | 2 | 5 | 4 | 4 | 5
Unsafe | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 | 1 | 1 | 1 | 1
Spam T.. | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 1 | 0 | 2 | 2 | 2 | 2 | 2
Bugs | - | 1 | - | - | - | - | - | 1 | - | - | - | - | - | 1
EtherDelta | - | 1 | - | - | - | - | - | 0 | - | - | - | - | - | 1
Cryptopia | - | 1 | - | - | - | - | - | 1 | - | - | - | - | - | 1
Gambling | 3 | 2 | 2 | 2 | 2 | 1 | 2 | 0 | 2 | 2 | 2 | 2 | 1 | 2
Suspicious | - | 1 | - | - | - | - | - | 0 | - | - | - | - | - | 1
Fake ICO | 1 | 1 | 1 | 1 | 0 $\bullet$ | 0 $\bullet$ | 1 | 1 | 1 | 1 | 1 $\odot$ | 1 $\odot$ | 1 | 1

  * •

$\dagger$ number of ‘Scamming’ accounts correctly classified by ETC is less
$\ddagger$ number of ‘Scamming’ accounts correctly classified by NN is more

  * •

$\bullet$ no ‘Fake ICO’ account correctly classified $\odot$ NN classifies
accounts associated with ‘Fake ICO’ correctly

  * •

‘-’ symbol represents that accounts associated with the particular malicious
activity were not present in our test set

  * •

‘Spam T..’ represents accounts associated with ‘Spam Token’ ; ‘Compro..’
represents accounts associated with ‘Compromised’

Table 5: Malicious activity based analysis of different confusion matrices for
ETC and NN. Note that here ‘Scam’ activity is not present as the only
associated account was selected in the Training dataset.

From the Table 5, we observe that for $C_{2}$, though only accounts attributed
to ‘Phishing’ activities are removed from the training dataset, more than 50%
of the accounts attributed to ‘Scamming’ are misclassified. Same results are
observed for $C_{3}$, when accounts associated with ‘Phishing’ are removed
from both the training dataset ($Tr^{C_{3}}$) and the test dataset
($Ts^{C_{3}}$). However, if ‘Phishing’ related accounts are present in the
training dataset, as in $C_{0}$, $C_{1}$ and $C_{4}$, less number of accounts
tagged as ‘Scamming’ are misclassified. A similar observation is made for the
accounts associated with ‘Fake ICO’. This is also obtained from the results in
the previous subsection (R1), where we see that ‘Phishing’ and ‘Scamming’
based accounts, show high similarity. This validates the results we obtain
using different configurations.

ML | $Ts^{C_{0}}$ | $D_{b}$ | $D_{g}$
---|---|---|---
algorithm | Mal | Ben | Mal | Ben | Mal | Ben
RF | 0.66 | 0.99 | 0.0 | 0.99 | 0.54 | 0.99
XG Boost | 0.70 | 0.99 | 0.003 | 0.99 | 0.60 | 0.99
DT | 0.71 | 0.99 | 0.04 | 0.98 | 0.67 | 0.99
ADaBoost | 0.51 | 0.99 | 0.001 | 0.99 | 0.56 | 0.99
Grad. Boost. | 0.72 | 0.99 | 0.006 | 0.99 | 0.38 | 0.99
ETC | 0.70 | 0.99 | 0.0 | 0.99 | 0.70 | 0.99
NN | 0.83 | 0.94 | 0.25 | 0.89 | 0.95 | 0.90
Table 6: Recall score obtained when different ML algorithms are trained on
$Tr^{C_{0}}$. Here ‘Mal’ represents malicious class, ‘Ben’ represents the
benign class, ‘RF’ represents RandomForest classifier, ‘DT’ represents
Decision Trees, ‘Grad. Boost.’ represent Gradient Boosting, ‘ETC’ represents
ExtraTrees classifier, and ‘NN’ represent Neural Networks.

Since ETC shows bias, we execute different supervised ML algorithms on the
different training and test sub-datasets created from $D_{a}$. Here, on the
features we have, we study those ML algorithms that were used by the related
works. Table 6 depicts the recall obtained after different supervised ML
algorithms were studied on $C_{0}$. Here, we keep the hyperparameters of the
supervised ML algorithms to either default or to those values that are
reported by the related works. Apart from the supervised ML algorithms
specified in Table 6, we also test the performance of GCN using our features
on the dataset $D_{a}$. GCN achieves a recall score of 32.1% on the dataset
$D_{a}$. From the set of ML algorithms, we identify that Neural Network (NN)
(with hyperparameters: epochs = 50, regularization = l2(0.0001), dropout =
0.5, loss=‘binary crossentropy’, optimizer=‘adam’) performs the best on
$C_{0}$ and achieves a recall $0.83$ on the malicious class. However recall on
benign class drops to $0.94$ resulting in a balanced-accuracy (average recall
on all classes) of $88.5\%$. We also note that although recall on malicious
class is high for NN, recall on benign class is relatively lower. Overall, the
balanced accuracy is still high. To understand if NN is biased towards
‘Phishing’, we execute NN on different training and test sub-datasets we have.
We find that NN has better recall on $C_{2}$ and $C_{3}$ as well (see Table
4). Further, we find that NN was able to correctly classify most of the
accounts associated with different malicious activities irrespective of the
bias (see Table 5).

Next, we perform experiments to understand which supervised ML algorithm
performs the best in the scenario when new data on already known malicious
activities is presented. From Figure 6, we find that the similarity between
the malicious accounts in $Ts^{C_{0}}$ and those in $D_{b}$ is less. We then
test the performance of different supervised ML algorithms using $D_{b}$ to
understand if these new malicious accounts are classified correctly on already
trained supervised ML algorithms, i.e., when we train on $Tr^{C_{0}}$ while
test on all benign accounts in $TS^{C_{0}}$ and all malicious account in
$D_{b}$. Table 6 also presents the recall score obtained in this scenario.
Here, we again observe that Neural Network performs better than the rest of
the supervised ML algorithms and was able to classify more than $434$ account
out of $1736$ malicious accounts. Thus, we get further confirmation that NN
performs the best and is not affected by the bias caused by high number of
accounts associated with ‘Phishing’ malicious activity in the Ethereum
transaction data.

####  4.2.3 R3: Adversarial Analysis

Next, to answer our other research question and test the effect of adversarial
data on the supervised ML algorithms, we first generate adversarial data from
accounts attributed to the particular malicious activities and then test
various supervised ML algorithms on the generated datasets ($D_{g}$). For each
malicious activity where the number of associated accounts are sufficiently
large, we generate $1000$ adversarial samples. For malicious activities that
are moderately represented, we generate 50 adversarial samples. Since for all
the other malicious activities we had less than 10 accounts, we did not
generated adversarial accounts for those malicious activities. Thus, in
$D_{g}$, the distribution of accounts associated with different malicious
activities is as follows: Phishing ($1000$ accounts), Scamming ($1000$
accounts), Upbit Hack ($1000$ accounts), Spam Token ($50$ accounts),
Compromised ($50$ accounts), Heist ($50$ accounts). Here, the number of
accounts generated for each malicious activity are in accordance to the number
of malicious accounts available for each activity. As for ‘Phishing’,
‘Scamming’, and ‘Upbit Hack’ the number of accounts were more, we generated
1000 each adversarial feature vectors. This number is randomly selected and is
based on the computational power available to us.

As expected, $D_{g}$ has a high similarity with the source dataset (see Figure
7a) and can be considered as the dataset meant to evade state-of-the-art ML
algorithms. From Figure 7a, we note that some pairs of accounts have low
similarity. This is true as Figure 7a shows similarity between all malicious
accounts which belong to different malicious activities. Nonetheless, if we
see the similarity just between accounts associated with ‘Phishing’ activity
in $D_{a}$ and in $D_{g}$, we observe a similar behavior (see Figure 7b). Some
accounts in $D_{g}$ show similarity as low as $-0.84$. This is true because
some malicious accounts associated with Phishing in $D_{a}$ had low
similarities amongst themselves (see Figure 5a). Since accounts in $D_{g}$ are
based the accounts in $D_{a}$, this dataset also shows a same behavior.

In this scenario, we observe that NN algorithm also achieved the best recall
($>94.8\%$) on the malicious class among the set of supervised ML algorithms
(see Table 6). Comparing with the instance when adversarial data was not
presented, we note that previously identified ML algorithms did not perform
well. Their recall is much less than $70.1\%$. For GCN, however, as $D_{g}$ is
a generated feature vector dataset, we did not have associated graph.
Therefore, we were not able to perform any tests on GCN. Here, we infer that
the identified NN model is more robust and is able to capture any adversarial
data/attack. Note that here we did not train NN on any adversarial feature
vectors.

We expect to achieve better results when some adversarial feature vectors are
provided in the training. To test the effect, we test of three different
training dataset configurations: (1) include 1% randomly selected accounts
from $D_{g}$, (2) 5% randomly selected accounts from $D_{g}$, and (3) 80%
feature vectors of all the malicious activities in $D_{g}$. For sake of
completeness, we test on supervised ML algorithms used in the related work.
Table 7 provides recall of both malicious and benign accounts, when different
algorithms are trained on above-mentioned three configurations. Here, we note
that RandomForest, for the default hyperparameter values, performs best in all
the three cases. Here NN, does perform well but recall on both malicious and
benign classes are better for RandomForest classifier. Further, note that
although recall is less for malicious class when we perform tests considering
80% feature vectors of all the malicious activities in $D_{g}$, but the
balance accuracy is better than the other two cases.

Figure 6: Cosine similarity between malicious accounts present in $D_{b}$ and
$Ts^{C_{0}}$.

(a) Cosine similarity between malicious accounts in $D_{a}$ and those in
$D_{g}$

(b) Cosine similarity between phishing accounts in $D_{a}$ and those in
$D_{g}$

Figure 7: Cosine Similarity Scores.

##  5 Conclusion and Discussions

With a rise in their adoption, permissionless blockchains are often victim to
various cyber-attacks, scams, and host to ransom payments. Most of the
security threats and malicious activities in permissionless blockchains
exploit the vulnerabilities exposed due to platform, network architecture,
programming bugs, and sometimes are socially engineered. Currently, different
ML algorithms are used in the state-of-the-art techniques to detect such
exploits. However, these techniques have limitations as they do not
distinguish between different types of the exploits.

ML | 1% | 5% | 80% of all
---|---|---|---
algorithm | Mal | Ben | Mal | Ben | Mal | Ben
RF | 0.94 | 0.99 | 0.99 | 0.99 | 1.00 | 0.99
XG Boost | 0.81 | 0.99 | 0.96 | 0.99 | 1.00 | 0.99
DT | 0.90 | 0.99 | 0.97 | 0.99 | 1.00 | 0.99
ADaBoost | 0.61 | 0.99 | 0.89 | 0.99 | 0.98 | 0.99
Grad. Boost. | 0.88 | 0.99 | 0.91 | 0.99 | 0.99 | 0.99
ETC | 0.80 | 0.99 | 0.93 | 0.99 | 1.00 | 0.99
NN | 0.92 | 0.96 | 0.97 | 0.87 | 0.93 | 0.96
Table 7: Recall score obtained when different ML algorithms are trained on
adversarial feature vectors. Here ‘Mal’ represents malicious class, ‘Ben’
represents the benign class, RF represents RandomForest classifier, DT
represents Decision Trees, Grad. Boost. represent Gradient Boosting, ETC
represents ExtraTrees classifier, and NN represent Neural Networks.

In this paper, we first study similarity among accounts to understand if
presented ML models are biased towards a specific malicious activity. We
identify that most of the malicious activities can be clustered in mostly 3
clusters and existing ML models are biased towards the malicious activity that
has maximum number of accounts associated with it. We then identify that NN,
despite such bias, was able to achieve much better recall on the malicious
class and also detect any adversarial attacks. Thus, in the future, if any
attacker is able to intelligently craft transactions that show adversarial
behavior, they can be detected. We identify that the NN is robust to such
adversarial attacks and is able to classify malicious account with high
recall. Further, even if 1% adversarial inputs are added to the training
dataset, performance of NN increases by 1.5% to achieve a balanced accuracy of
94%. However, in this case RandomForest classifier performs the best among the
set of supervised ML algorithms and achieves a balanced accuracy of 96.5%.
Nonetheless, the performance of NN (or any other supervised algorithm) could
vary if any new features are introduced. Further, we obtained the labels
representing malicious activities from Etherscan that uses crowd-sourced
mechanism where anyone can suggest a label name for an account333Name Tagging
In Etherscan: https://etherscan.io/contactus. Such aspects cause diversity in
the label names where these label names could refer to the same malicious
activity. This raises questions upon the correctness of the label names.
Nonetheless, one could use natural language processing (NLP) approaches to
identify similar label names and group them accordingly.

One future direction that we would like to pursue following this study is to
analyse the behavior of accounts associated with new malicious activities in
the permissionless blockchains. For this, we would like to integrate ‘Active
Learning’ into our ML pipeline to do real-time analysis of the accounts.
Since, in our study, we do not focus on the internal transactions, we would
also like to use them to detect transactions based anomalies such as those
caused due to BZX exploit444BZX Exploit:
https://etherscan.io/accounts/label/bzx-exploit. Since internal transactions
are carried out by smart contracts, studying them would help better understand
the transactional behavior of the smart contracts, and thus detect those
attacks as well where transactions utilize multiple SCs. As reported before,
we observed that, in most cases, the creator (either an EOA or an SC) of the
SC which is involved in malicious activity as well as the SC created by such
malicious SC is not tagged as malicious. Therefore, we would like to analyse
such accounts as well in future.

## Acknowledgement

We thank the authors of [1] for sharing with us the account hashes of all the
2946 malicious accounts until 7th December 2019, 680,314 benign accounts, and
1736 malicious accounts until 27th May 2020.

## Availability

All our codes along with list of malicious accounts used are available for re-
use and test upon request.

## References

  * [1] R. Agarwal, S. Barve, and S. Shukla.  Detecting malicious accounts in permissionless blockchains using temporal graph properties.  arXiv, pages 1–27, July 2020.
  * [2] I. Alarab, S. Prakoonwit, and M. Nacer.  Competence of graph convolutional networks for anti-money laundering in bitcoin blockchain.  In Proceedings of the 5th International Conference on Machine Learning Technologies, pages 23–27, Beijing, China, June 2020. ACM.
  * [3] A. Alkhalifah, A. Ng, A. Kayes, J. Chowdhury, M. Alazab, and P. Watters.  A Taxonomy of Blockchain Threats and Vulnerabilities.  In Y. Maleh, M. Shojafar, M. Alazab, and I. Romdhani, editors, Blockchain for Cybersecurity and Privacy, pages 3–28. CRC Press, August 2020\.
  * [4] M. Bartoletti, B. Pes, and S. Serusi.  Data Mining for Detecting Bitcoin Ponzi Schemes.  In Crypto Valley Conference on Blockchain Technology, pages 75–84, Zug, June 2018.
  * [5] Behind MLM.  Plus token ponzi collapses, chinese media report $2.9 billion in losses, July 2019.  (Accessed 04/10/2020) https://bit.ly/2SuLuSI.
  * [6] Vitalik Buterin.  Ethereum: A Next-Generation SmartContract and Decentralized Application Platform, July 2013.  (Accessed 30/07/2020) https://ethereum.org/whitepaper/.
  * [7] H. Chen and L. Jiang.  Efficient GAN-based method for cyber-intrusion detection.  arXiv, pages 1–6, July 2019.
  * [8] H. Chen, M. Pendleton, L. Njilla, and S. Xu.  A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses.  ACM Computing Surveys, 53(3):1–43, June 2020.
  * [9] Z. Cheng, X. Hou, R. Li, Y. Zhou, X. Luo, J. Li, and K. Ren.  Towards a First Step to Understand the Cryptocurrency Stealing Attack on Ethereum.  In 22nd International Symposium on Research in Attacks, Intrusions and Defenses, pages 47–60, Beijing, September 2019. USENIX Association.
  * [10] M. De Choudhury.  Tie Formation on Twitter: Homophily and Structure of Egocentric Networks.  In Third International Conference on Privacy, Security, Risk and Trust and Third International Conference on Social Computing, pages 465–470, Boston, October 2011. IEEE.
  * [11] Etherscan.  Ethereum Developer APIs, October 2020.  (Accessed 09/10/2020) https://etherscan.io/apis.
  * [12] Etherscan.  Label Word Cloud, October 2020.  (Accessed 09/10/2020) https://etherscan.io/labelcloud/.
  * [13] I. Goodfellow, J. Abadie, M. Mirza, B. Xu, D. Farley, S. Ozair, A. Courville, and Y. Bengio.  Generative Adversarial Nets.  In Proceedings of the 27th International Conference on Neural Information Processing Systems - Volume 2, NIPS’14, page 2672–2680, Montreal, Canada, December 2014.
  * [14] Hacken.  How to avoid a hack: Cryptopia ‘success’ case, February 2019.  (Accessed 04/10/2020) https://hacken.io/research/researches-and-investigations/how-to-avoid-a-hack-cryptopia-success-case/.
  * [15] M. Huillet.  Upbit hack: Stolen eth worth millions on the move to unknown wallets, December 2019.  (Accessed 04/10/2020) https://bit.ly/3ixgeNp.
  * [16] M. Karsai, K. Kaski, A. Barabási, and J. Kertész.  Universal features of correlated bursty behaviour.  Scientific Reports, 2(397):1–7, May 2012.
  * [17] J. Lorenz, M. Silva, D. Aparício, J. Ascensao, and P. Bizarro.  Machine learning methods to detect money laundering in the bitcoin blockchain in the presence of label scarcity.  arXiv, May 2020.
  * [18] S. Nakamoto.  Bitcoin: A peer-to-peer electronic cash system, 2009.  https://bitcoin.org/bitcoin.pdf.
  * [19] T. Pham and S. Lee.  Anomaly Detection in Bitcoin Network Using Unsupervised Learning Methods.  Technical report, Stanford, November 2016.
  * [20] D. Riley.  $25M in cryptocurrency stolen in hack of Lendf.me and Uniswap, April 2020.  (Accessed 04/10/2020) https://bit.ly/34MjeRc.
  * [21] J. Russell.  The crypto world’s latest hack sees bancor lose $23.5m, July 2018.  (Accessed 04/10/2020) https://techcrunch.com/2018/07/10/bancor-loses-23-5m/.
  * [22] N. Samreen and M. Alalfi.  Reentrancy vulnerability identification in ethereum smart contracts.  In International Workshop on Blockchain Oriented Software Engineering, pages 22–29, London, February 2020. IEEE.
  * [23] K. Sedgwick.  One Week On from the Etherdelta Hack, Funds Are Still Being Stolen, December 2017.  (Accessed 04/10/2020) https://news.bitcoin.com/one-week-etherdelta-hack-funds-still-stolen/.
  * [24] M. Spagnuolo, F. Maggi, and S. Zanero.  BitIodine: Extracting Intelligence from the Bitcoin Network.  In N. Christin and R. Safavi-Naini, editors, Proc. of 18th Financial Cryptography and Data Security, pages 457–468, Christ Church, Barbados, March 2014. Springer Berlin Heidelberg.
  * [25] N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdinov.  Dropout: A simple way to prevent neural networks from overfitting.  Journal of Machine Learning Research, 15(1):1929–1958, January 2014\.
  * [26] D. Watts and S. Strogatz.  Collective dynamics of ‘small-world’ networks.  Nature, 393(6684):440–442, June 1998.
  * [27] J. Wu, Q. Yuan, D. Lin, W. You, W. Chen, C. Chen, and Z. Zheng.  Who are the phishers? phishing scam detection on ethereum via network embedding.  Transactions on Systems, Man, and Cybernetics: Systems, pages 1–11, September 2020.
  * [28] L. Xu, M. Skoularidou, A. Infante, and K. Veeramachaneni.  Modeling Tabular data using Conditional GAN.  In 33rd Conference on Neural Information Processing Systems (NeurIPS 2019), pages 1–11, Vancouver, December 2019. NIPS proceedings.
  * [29] M. Zhang, X. Zhang, Y. Zhang, and Z. Lin.  TXSPECTOR: Uncovering attacks in ethereum from transactions.  In 29th USENIX Security Symposium, pages 2775–2792. USENIX Association, August 2020.
  * [30] W. Zhao.  Bitpoint exchange hacked for $32 million in cryptocurrency, July 2019\.  (Accessed 04/10/2020) https://bit.ly/30yY7jP.
  * [31] F. Zola, M. Eguimendia, J. Bruse, and R. Urrutia.  Cascading Machine Learning to Attack Bitcoin Anonymity.  In 2nd International Conference on Blockchain, pages 10–17, Atlanta, July 2019. IEEE.

##  Appendix A Appendix: Burst and Attractiveness

This section provides a brief overview of the Burst and Attractiveness related
features which we have used in our study:

  * •

Burst: An entity is said to exhibit bursty behavior if it shows irregular
changes in the sequence of events associated with it. Bursts for different
entities is defined as:

    1. 1.

Degree Burst: In graph theory, the degree of a vertex is defined as the number
of edges it has. An entity is said to have a ‘Degree Burst’ if the number of
edges the entity has at a given epoch is greater than a threshold value. With
respect to blockchains, such aspect captures irregularity shown by the
malicious accounts, such as those involved in ‘Upbit Hack’.

    2. 2.

Balance Burst: In our work, we say that a particular account has a ‘Balance
Burst’ if the crypto-currency involved in a transaction by the same account at
a particular epoch is greater than a threshold value. Usually, accounts
involved in malicious activities, such as money laundering, tend to transfer
high amount of crypto-currency. Capturing such events would lead to
identification of accounts showing malicious behavior, such as the accounts
involved in Silk-Road activities [24].

    3. 3.

Transaction fee Burst: An adversary can attempt to bribe a miner into
accepting a particular transaction in a block by raising the fee corresponding
to a transaction. Capturing burst of fees paid, would capture such instances.
Therefore, ‘Transaction fee Burst’ is the number of instances where the
‘Transaction fee’ involved in a transaction is greater than a threshold value.

    4. 4.

Inter-event time burst: Inter-event time is defined as the time between two
transactions. There can be instances where an account in a blockchain
transacts with others such that the distribution of inter-event time is non-
uniform. Such non-uniformity, leads to having multiple transactions in a short
time period. Therefore, ‘Inter-event time burst’ is defined to capture such
aspects.

  * •

Attractiveness : The accounts involved in malicious activities usually tend to
carry out transactions with the new accounts overtime. Such accounts show less
stability in terms of accounts they have transacted with before.
‘Attractiveness’ for an account is thus the probability of an account
receiving crypto-currency from a previously unknown accounts at a given epoch.

##  Appendix B Appendix: List of Features used

The set of 59 features used in our work is: $F=\\{$indegreeTimeInv,
outdegreeTimeInv, degreeTimeInv, numberOfburstTemporalInOut,
longestBurstTemporalInOut, numberOfburstTemporalIn, longestBurstTemporalIn,
numberOfburstTemporalOut, longestBurstTemporalOut, numberOfburstDegreeInOut,
longestBurstDegreeInOutAtTime, numberOfburstDegreeIn,
longestBurstDegreeInAtTime, numberOfburstDegreeOut,
longestBurstDegreeOutAtTime, zeroTransactions, totalBal, transactedFirst,
transactedLast, activeDuration, averagePerInBal, uniqueIn, lastActiveSince,
indegree__index_mass_quantile__q_0.1,
indegree__energy_ratio_by_chunks__num_segments_10__-segment_focus_0,
indegree__linear_trend__attr_“pvalue", ittime__quantile__q_0.7,
ittime__fft_coefficient__coeff_0__attr_“real", ittime__median,
outdegree__energy_ratio_by_chunks__num_segments_10-__segment_focus_0,
outdegree__enegy_ratio_by_chunks__-num_segments_10__segment_focus_1,
outdegree__fft_coefficient__coeff_0__attr_“real", gasPrice__quantile__q_0.2,
gasPrice__quantile__q_0.1, gasPrice__cwt_coefficients__widths_(2, 5, 10,
20)__coeff_0__w_20, attractiveness__median, attractiveness__quantile__q_0_0.4,
attractiveness__mean, balanceOut__quantile__q_0.1,
balanceOut__quantile__q_0.3, balanceOut__cwt_coefficients__widths_(2, 5, 10,
20)__coeff_0__w_2, balanceIn__quantile__q_0.4, balanceIn-
__cwt_coefficients__widths_(2, 5, 10,20)__coeff_0__w_20,
balanceIn__quantile__q_0.3, maxInPayment__quantile__q_0.3,
maxInPayment__quantile__q_0.2, maxInPayment__cwt_coefficients__widths_(2, 5,
10, 20)__coeff_0__w_5, maxOutPayment__quantile__q_0.6,
maxOutPayment__quantile__q_0.1, maxOutPayment__cwt_coefficients__widths_(2, 5,
10, 20)__coeff_0__w_2, clusteringCoeff, burstCount_gasPrice,
burstCount_balanceIn, burstCount_balanceOut, burstInstance_indegree,
burstInstance_outdegree, burstInstance_outdegree, burstInstance_maxInPayment,
burstInstance_maxOutPayment, burstInstance_gasPrice$\\}$


[1]R. Chen

1]Department of Physics and Astronomy, Northwestern University, 633 Clark St,
Evanston, 60208, IL, US

2]Argonne National Laboratory, 9700 S Cass Ave, Lemont, 60439, IL, US

3]Department of Physics, University of Massachusetts Amherst, 710 N Pleasant
St, Amherst, 01003, MA, US

4]Department of Physics, University of Toronto, 27 King’s College Cir,
Toronto, M5R 0A3, ON, Canada

5]Department of Physics, Massachusetts Institute of Technology, 77
Massachusetts Ave, Cambridge, 02139, MA, Canada

# Modeling and characterization of TES-based detectors for the Ricochet
experiment

*<EMAIL_ADDRESS>E. Figueroa-Feliciano  G. Bratrud  C.L. Chang  L. Chaplinsky  E. Cudmore  W. Van De Pontseele  J. A. Formaggio  P. Harrington  S. A. Hertel  Z. Hong  K. T. Kennard  M. Li  M. Lisovenko  L. O. Mateo  D. W. Mayer  V. Novati  P.K. Patel  H. D. Pinckney  N. Raha  F. C. Reyes  A. Rodriguez  B. Schmidt  J. Stachurska  C. Veihmeyer  G. Wang  L. Winslow  V.G. Yefremenko  J. Zhang  [  [  [  [  [

###### Abstract

Coherent elastic neutrino-nucleus scattering (CENS) offers a valuable approach
in searching for physics beyond the Standard Model. The Ricochet experiment
aims to perform a precision measurement of the CENS spectrum at the Institut
Laue–Langevin nuclear reactor with cryogenic solid-state detectors. The
experiment plans to employ an array of cryogenic thermal detectors, each with
a mass around 30 g and an energy threshold of sub-100 eV. The array includes
nine detectors read out by Transition-Edge Sensors (TES). These TES based
detectors will also serve as demonstrators for future neutrino experiments
with thousands of detectors. In this article we present an update in the
characterization and modeling of a prototype TES detector.

###### keywords:

CENS, BSM physics, neutrino, TES, cryogenic calorimeter

##  1 Introduction

In 1974, Daniel Freedman predicted that for sufficiently small momentum
transfers, neutrinos can interact coherently with nuclei [1]. The process,
known as Coherent Elastic Neutrino()-Nucleus Scattering (CENS), evaded
detection until 2017. The COHERENT experiment measured CENS at the Spallation
Neutron Source (SNS) with a neutrino energy of $\sim$30 MeV [2]. This
measurement took advantage of the enhanced cross section with the coherent
interaction, enabling a detection with kg-scale target mass rather than the
traditional ton-scale neutrino detectors.

The Ricochet experiment[3, 4] aims to measure the spectrum of CENS with high-
statistics and high-precision at the Institut Laue–Langevin (ILL) nuclear
reactor in Grenoble, France. The experiment is located 8.8 m from the reactor
core, which provides a high neutrino flux that is $\sim$1000 times higher than
that from the SNS. However, the lower energy of neutrinos from the reactor
requires a lower detector threshold ($\sim 50$ eV) to take advantage of this
ﬂux. To achieve such a low energy threshold, the Ricochet experiment will
employ cryogenic calorimeters. Two technologies—Neutron Transmutation Doped
(NTD) thermistors and Transition Edge Sensors (TES)—will be used. The NTD-
based detector array is called the Cryocube [5, 6] and the TES-based detector
array is named the Q-Array [7]. This paper focuses on the development of the
TES-based detector and characterization of a prototype detector with a
germanium target.

##  2 Detector Architecture and Experiment Setup

###  2.1 Detector Architecture

A Q-Array style detector consists of two components [8]:

  * 1)

A target constituted by a crystal with a thin gold film deposited on the
surface;

  * 2)

A modular thermal sensor equipped with a TES reading out the temperature
excitation from the target.

In its quiescent state the detector target is held near the critical
temperature of the TES. Particle interactions raise the temperature of the
target. A 300-nm thick gold film is deposited with an electron beam evaporator
onto the target to collect the energy released by the particle interaction
through electron-phonon coupling. The absorbed energy is guided from the gold
film to the TES sensor via a gold wire bond. The other end of the TES sensor
is connected to the thermal bath via an engineered thermal impedance. The
thermal impedance, referred to as a “meander”, controls the heat flow through
the TES. The TES and the meander are deposited on a $3\times 3\times 0.4$ mm3
silicon chip. The sensor modularity and separation from the target makes this
detector architecture easily scalable and allows for flexibility in the target
material choice. The electrical signal generated by the TES is read out via
two niobium traces which connect to a Superconducting Quantum Interference
Device (SQUID) nearby the detector housing.

###  2.2 Experiment Setup

We tested a germanium target with the modular TES-based sensor described in
Sec. 2.1. The TES consists of an Al/Mn bi-layer with a critical temperature of
20 mK, fabricated by Argonne National Laboratory. More details of the TES chip
will be presented in a companion paper [9]. The detector is housed in a light-
tight copper holder. The germanium target is held by 8 sapphire spheres [10]
to isolate the target from copper holder, where in this case the copper holder
functions as a thermal bath. The TES chip is glued to the housing using GE
Varnish. The germanium target was activated using an Pu-Be source, resulting
in the generation of an activated peak at 10.37 keV from ${}^{71}\mathrm{Ge}$
decay.

The detector was operated in a Cryoconcept dilution refrigerator situated at
the Northwestern Experimental Underground Site (NEXUS) [11, 12] at Fermilab
(Batavia, IL). The cryostat was stabilized at a base temperature of 10 mK. We
used a single-stage DC SQUID to read out the TES.

##  3 Complex Impedance Measurement and Modeling

The complex impedance of the detector was measured and leveraged to
characterize the device. To measure the complex impedance, a signal generator
injects sine waves with varying frequencies and amplitudes into the TES bias
circuit [13]. Meanwhile, the readout circuit records the detector response to
these injected signals. The complex impedance was measured from 2 Hz to 5 kHz.
Figure 1 shows the result of the complex impedance measurement with our
detector and also for a TES-only device by theory. It illustrates that the
complex impedance of our detector is significantly different from the theory.

In order to gain a better understanding of the detector’s behavior, optimize
its design and improve its future performance, we constructed a numerical
model for simulating this specific type of detector [8, 14, 15]. In the model,
each component is simplified as a point with a heat capacity and zero thermal
diffusion relaxation time, as shown in Fig. 2. The thermal connections between
components are described by a set of linearized thermal diffusion equations.

This work aimed to model both the static and dynamic response of the detector
by reproducing the complex impedance results and the average pulse and allows
us to estimate:

  * 1)

Heat capacities of each component;

  * 2)

Thermal conductance between each component;

  * 3)

Temperature sensitivity and current sensitivity of the TES [16].

A Markov Chain Monte Carlo (MCMC) was used to fit the complex impedance data.
Parameters selected for the MCMC optimization are highlighted with a red box
or arrow in Fig. 2 (left).

Categories | Parameters | units | MCMC | MCMC
---|---|---|---|---
|  |  | initialization | results
TES Parameters | Temperature sensitivity of TES | No Unit | 9 | 18
Current sensitivity of TES | No Unit | 1.00 | 0.96
Heat Capacities | Germanium Target | J/K | $2.7\times 10^{-10}$ | $2.7\times 10^{-10}$
Au Pad 1 | J/K | $2.2\times 10^{-10}$ | $2.2\times 10^{-10}$
Wire Bond 1 | J/K | $5.5\times 10^{-12}$ | $5.5\times 10^{-12}$
Au Pad 2 | J/K | $2.5\times 10^{-14}$ | $2.5\times 10^{-14}$
TES | J/K | $5.1\times 10^{-15}$ | $2.2\times 10^{-14}$
Si Chip | J/K | $1.3\times 10^{-14}$ | $1.3\times 10^{-14}$
Meander | J/K | $2.1\times 10^{-14}$ | $2.1\times 10^{-14}$
Wire Bond 2 | J/K | $2.8\times 10^{-12}$ | $2.8\times 10^{-12}$
Glue | J/K | $2.1\times 10^{-13}$ | $2.0\times 10^{-13}$
Thermal Conductances | Between Target and Cold Bath | W/K | $2.4\times 10^{-11}$ | $2.4\times 10^{-11}$
Between Target and Au Pad 1 | W/K | $3.5\times 10^{-8}$ | $3.5\times 10^{-8}$
Between Au Pad 1 and Wire Bond 1 | W/K | $1.7\times 10^{-5}$ | $1.7\times 10^{-5}$
Between Wire Bond 1 and Au Pad 2 | W/K | $1.7\times 10^{-5}$ | $1.7\times 10^{-5}$
Between Au Pad 2 and TES | W/K | $1.9\times 10^{-7}$ | $5.9\times 10^{-9}$
Between Au Pad 3 and TES | W/K | $1.9\times 10^{-7}$ | $5.9\times 10^{-9}$
Between Au Pad 2 and Si Chip | W/K | $4.3\times 10^{-11}$ | $4.3\times 10^{-11}$
Between TES and Si Chip | W/K | $4.4\times 10^{-11}$ | $2.2\times 10^{-9}$
Through Gold Pad 3 and Meander | W/K | $4.9\times 10^{-10}$ | $4.9\times 10^{-10}$
Between Meander and Si Chip | W/K | $8.8\times 10^{-12}$ | $8.8\times 10^{-12}$
Between Si Chip and Glue | W/K | $1.3\times 10^{-6}$ | $1.3\times 10^{-6}$
Between Glue to Cold Bath | W/K | $1.8\times 10^{-11}$ | $9.1\times 10^{-10}$
Between Meander and Wire Bond 2 | W/K | $8.7\times 10^{-6}$ | $8.7\times 10^{-6}$
Between Wire Bond 2 and Cold Bath | W/K | $8.7\times 10^{-6}$ | $8.7\times 10^{-6}$
Simulation Parameter | Fraction of Energy into Target | No Unit | 100% | 50%
Table 1: Initial parameter values and final fit values for the heat
capacities, thermal conductances, TES parameters and energy fraction used in
the MCMC fit.

The MCMC method is implemented through a python package called “PyMC3” [17]
which uses gradient-based MCMC algorithms.

Figure 1: Left panel: average pulse (blue) from 10.37 keV and its simulation
(orange). Right panel: The data (blue) are compared to the simulation (orange)
and the compled impedance for a TES-only device (green).

Figure 1 shows the complex impedance data and the average pulse (blue), and
its MCMC fit to the simulation (orange). Parameters from the MCMC fit are
reported in Table 1. Figure 2 (right) shows the corner plot of the MCMC fit
which illustrates the distribution of each parameter in the Markov chain and
their correlation with the other parameters. A definition of parameters in the
corner plot can be found in Table 2.

Despite being a thermal detector, athermal processes can still occur and
impact the pulse shape. To simulate this phenomenon in the model, instead of
injecting the total energy from an event directly into the target, a fraction
of the energy is injected into gold pad 1. The thermal impedance between this
pad and the TES is smaller and can be used to simulate the effects of faster
thermalization to the gold through athermal processes. The fraction of energy
injected into the gold pad 1 is defined as $\mathrm{frac_{energy}}$, as shown
in the corner plot Fig. 2 (right).

A discussion of results follows:

  * 1)

The value $\mathrm{G_{aute}}$ is the thermal conductance between gold pad 2
and 3, and the TES. The difficulty in accurately estimating the thermal
conductance through the interface between nanometer scale thin films has
resulted in a large uncertainty. To avoid over-constraining the fit, we have
estimated the thermal conductance through the gold pad, which sets a fairly
high upper limit for $\mathrm{G_{aute}}$, and assume a flat prior down to zero
conductance. The corner plot shows that the fit prefers a value 3 % of the
first estimation. A lower conductance indicates a slow response time of the
detector and a lower the energy efficiency because some energy will bypass the
TES. In future experiments, we will employ a different chip which has a larger
overlap area between gold pad and TES to improve this conductance.

  * 2)

The factor $\mathrm{f_{Gsitegb}}$ controls the thermal conductance from TES
through glue to the cold bath. The value of 50 from the MCMC fitting indicates
a large thermal conductance through the glue which could allow energy to enter
the thermal bath without passing through the TES. This detrimental effect will
be mittigated by new mounting strategies, such as clamping the chip
mechanically, will be tested to reduce this effect.

Figure 2: Left panel: Block-line diagram of the model. Each block represents a component with a heat capacity, while lines represent thermal conductances between these components. The components enclosed within a red box or marked with a red arrow were variated within the MCMC fitting process. All values are converged parameters from the MCMC fitting. Right panel: Corner Plot from the MCMC Fitter. The meaning of each parameters is shown in Table 2. The histograms below each parameter show how the Markov chain distribution is spread out for that specific parameter. The density plots at the intersections of each pair of parameters reveal how the multidimensional distribution of the Markov chain is projected onto those two specific parameters. Ref. # in | Ref. in |
---|---|---
Fig. 2 | Fig. 2 | Description
(left) | (right) |
1 |  |  , Temperature sensitivity of TES
2 |  |  , Current sensitivity of TES
3 | $\mathrm{f_{Gaute}}$ | Factor for Therm. Cond. between Gold and TES
4 | $\mathrm{f_{cte}}$ | Factor for heat capacity of TES
5 | $\mathrm{f_{cg}}$ | Factor for heat capacity of glue
6 | $\mathrm{f_{Gsitegb}}$ | Factor for Therm. Cond. from TES to the cold bath
7 | $\mathrm{frac_{energy}}$ | Fraction of energy injected into target, rest injects to the gold pad 1
Table 2: Definition of the parameters varied in MCMC fitting. The heat
capacities and thermal conductances (Therm. Cond.) are multiplied by a factor.

##  4 Conclusion and Plan

A germanium detector equipped with a modular TES-based sensor was tested and
characterized at the NEXUS test facility. Currently we are suffering from a
vibrations induced noise by the pulse tube so that the energy resolution is
not ideal so we focused on the complex impedance measurement and modeling.

The successful concurrent fitting of pulse shape and complex impedance
measurements have enabled us to gain insights into the heat capacities and
thermal conductance of the system as well as identify key limitations
affecting performance. For example, the thermal conductance from the target to
TES is lower than the original estimation which may limit the energy
efficiency. This limit will be tackled with a newer version of the modular
sensor design, which is capable of improving thermal diffusion along the TES
thanks to a larger overlap area between gold and TES, thereby reducing the
decay time constant and increase the energy efficiency. These ongoing efforts
are geared towards further enhancing the performance and capabilities of the
detector system.

##  5 Acknowledgements

This work is supported in part by NSF grant PHY-2209585, the Connaught Fund at
University of Toronto, and the Canada First Research Excellence Fund through
the Arthur B. McDonald Canadian Astroparticle Physics Research Institute. This
research was enabled in part by support provided by SciNet (www.scinethpc.ca)
and the Digital Research Alliance of Canada (alliancecan.ca). This work is
part of R&D for Ricochet experiment and we would like to thank all members of
Ricochet.

This work made use of the NUFAB facility of Northwestern University’s NUANCE
Center, which has received support from the SHyNE Resource (NSF ECCS-2025633),
the IIN, and Northwestern’s MRSEC program (NSF DMR-1720139).

Work at Argonne National Lab, including work performed at the Center for
Nanoscale Materials, a U.S. Department of Energy Office of Science User
Facility, is supported by the U.S. Department of Energy, Office of Science,
Office of High Energy Physics and Office of Basic Energy Sciences, under
Contract No. DE-AC02-06CH11357.

A portion of the work carried out at MIT was supported by a U.S. Department of
Energy (DOE) DOE QuantISED award DE-SC0020181, the NSF under Grant
PHY-2110569, and the Heising-Simons Foundation, United States.

## Data Availability

The datasets analysed during the current study are available from the
corresponding author on reasonable request.

## References

  *   * D.Z. Freedman [1974] D.Z. Freedman: Coherent effects of a weak neutral current. Phys. Rev. D 9, 1389 (1974) https://doi.org/10.1103/PhysRevD.9.1389
  * D. Akimov et al. [2017] D. Akimov, J. B. Albert, P. An et al.: Observation of coherent elastic neutrino-nucleus scattering. Science 357, 1123 (2017) https://doi.org/10.1126/science.aao0990
  * C. Augier et al. [2023a] C. Augier, G. Beaulieu, V. Belov, et al.: Ricochet progress and status. J Low Temp Phys 212(3), 127–137 (2023) https://doi.org/10.1007/s10909-023-02971-5
  * C. Augier et al. [2023b] C. Augier, G. Beaulieu, V. Belov et al.: Fast neutron background characterization of the future ricochet experiment at the ill research nuclear reactor. Eur Phys J C Part Fields 83(1), 20 (2023) https://doi.org/%****␣main.bbl␣Line␣100␣****10.1140/epjc/s10052-022-11150-x
  * T. Salagnac et al. [2023] T. Salagnac, J. Billard, J. Colas et al.: Optimization and Performance of the CryoCube Detector for the Future RICOCHET Low-Energy Neutrino Experiment. J. Low Temp. Phys. 211, 398–406 (2023) https://doi.org/10.1007/s10909-023-02960-8
  * C. Augier et al. [2023a] C. Augier, G. Beaulieu, V. Belov et al.: First demonstration of 30 eVee ionization energy resolution with Ricochet germanium cryogenic bolometers (2023)
  * C. Augier et al. [2023b] C. Augier, G. Beaulieu, V. Belov et al.: Results from a prototype tes detector for the ricochet experiment. Nucl Instrum Methods Phys Res A 1057, 168765 (2023) https://doi.org/10.1016/j.nima.2023.168765
  * R. Chen et al. [2023] R. Chen, H. D. Pinckney, E. Figueroa-Feliciano et al.: Transition Edge Sensor Chip Design of a Modular CENS Detector for the Ricochet Experiment. J. Low Temp. Phys. 211, 237–247 (2023) https://doi.org/10.1007/s10909-022-02927-1
  * [9] G. Wang et al: Properties of Low Tc AlMn TES (manuscript in preparation)
  * H.D. Pinckney et al. [2022] H.D. Pinckney, G. Yacteen, A. Serafin et al: The thermal conductance of sapphire ball based detector clamps. J. Low Temp. Phys. 209, 1204–1211 (2022) https://doi.org/10.1007/s10909-022-02777-x
  * R. Ren et al. [2021] R. Ren, C. Bathurst, Y. Y. Chang et al.: Design and characterization of a phonon-mediated cryogenic particle detector with an eV-scale threshold and 100 keV-scale dynamic range. Phys. Rev. D 104, 032010 (2021) https://doi.org/10.1103/physrevd.104.032010
  * M. Battaglieri et al. [2017] M. Battaglieri, A. Belloni, A. Chou et al.: US Cosmic Visions: New Ideas in Dark Matter 2017: Community Report (2017)
  * K. Hattori et al. [2020] K. Hattori, R. Kobayashi, S. Takasu, D. Fukuda: Complex impedance of a transition-edge sensor with sub-μs time constant. AIP Adv. 10, 035004 (2020) https://doi.org/10.1063/1.5127100
  * Figueroa-Feliciano [2006] Figueroa-Feliciano, E.: Complex microcalorimeter models and their application to position-sensitive detectors. J. Appl. Phys. 99, 114513 (2006) https://doi.org/10.1063/1.2191449
  * N. Bastidon et al. [2018] N. Bastidon, J. Billard, E. Figueroa-Feliciano, S. Heine, Z. Hong, H. D. Pinckney: Optimizing thermal detectors for low-threshold applications in neutrino and dark matter experiments. J Low Temp Phys 193(5), 1206–1213 (2018) https://doi.org/10.1007/s10909-018-2073-2
  * Irwin and Hilton [2005] Irwin, K.D., Hilton, G.C.: In: Enss, C. (ed.) Transition-Edge Sensors, pp. 63–150. Springer, Berlin, Heidelberg (2005). https://doi.org/10.1007/10933596_3
  * J. Salvatier et al. [2016] J. Salvatier, T. V. Wiecki, C. Fonnesbeck: Probabilistic programming in Python using PyMC3. PeerJ Comput. Sci. 2, 55 (2016) https://doi.org/10.7717/peerj-cs.55