  Due to the decentralized and public nature of the Blockchain ecosystem, the
malicious activities on the Ethereum platform impose immeasurable losses for
the users. Existing phishing scam detection methods mostly rely only on the
analysis of original transaction networks, which is difficult to dig deeply
into the transaction patterns hidden in the network structure of transaction
interaction. In this paper, we propose a \underline{T}ransaction
\underline{S}ub\underline{G}raph \underline{N}etwork (TSGN) based phishing
accounts identification framework for Ethereum. We first extract transaction
subgraphs for target accounts and then expand these subgraphs into
corresponding TSGNs based on the different mapping mechanisms. In order to make
our model incorporate more important information about real transactions, we
encode the transaction attributes into the modeling process of TSGNs, yielding
two variants of TSGN, i.e., Directed-TSGN and Temporal-TSGN, which can be
applied to the different attributed networks. Especially, by introducing TSGN
into multi-edge transaction networks, the Multiple-TSGN model proposed is able
to preserve the temporal transaction flow information and capture the
significant topological pattern of phishing scams, while reducing the time
complexity of modeling large-scale networks. Extensive experimental results
show that TSGN models can provide more potential information to improve the
performance of phishing detection by incorporating graph representation
learning.
