How AI-Driven Graph-based Anomaly Detection Enhances Web3 Security

Strengthening Decentralized Systems: The Synergy of AI and Anomaly Detection in Web3
How AI-Driven Graph-based Anomaly Detection Enhances Web3 Security


In the ever-evolving landscape of Web3, where decentralized technologies like blockchain reshape digital interactions, security becomes paramount. AI-driven Graph-based Anomaly Detection (GBAD) emerges as a crucial tool in safeguarding this decentralized realm.

This technology harnesses the power of artificial intelligence to identify irregular patterns, malicious behavior, and potential threats within complex networks, fortifying Web3's security infrastructure.

Three types of Anomalous Nodes

Graph-Based Anomaly Detection (GBAD) comes in various flavors to detect different types of anomalies in networks:

  1. Anomalous Nodes: These are like the odd ones out in a network. Each node is checked for unusual features, such as its connections, and assigned a score based on factors like input/output connections and ego net density.
  2. Anomalous Edges: Think of these as quirky relationships within the network. It's a subset of edges that behave strangely, often with scores that raise an alarm, similar to anomalous nodes.
  3. Irregular Subgraphs: These are like puzzle pieces within the network. Community detection methods identify these puzzle pieces (subgraphs), and then each piece is scored by comparing it to the rest of the network.
  4. Event and Change Detection: This one is exclusive to dynamic networks. It hunts for periods where activities stand out from the norm.

Structural Representation in GBAD:

When it comes to representing networks for anomaly detection, we have two approaches:

  • Feature Engineering: Think of this as manual crafting. We design features based on what we know about the network and potential suspicious activities. These can be simple, like how many connections a node has, or more complex, like clustering patterns.
  • Graph Representation Learning: Here, it's more about letting the computer figure things out. Advanced techniques like deep learning are used to construct models without needing much human input. They uncover hidden patterns that experts might miss.

Emerging Trends in GBAD:

GBAD is on the rise, especially in fraud detection:

Conventional Anomaly Detection
Graph Anomaly Detection
  • Expanding into New Fields: GBAD isn't just for fraud. It's making its mark in insurance, banking (since 2017), and even blockchain systems (since 2022).
  • Social Media Scrutiny: With businesses going digital, fraudsters see a goldmine. Detecting fraud in social media is becoming crucial as online activities grow.
  • Supervised vs. Unsupervised: Most GBAD studies (87.2%) prefer unsupervised learning because labeled data is often scarce. Only a small portion (5.1%) relies on supervised learning.

Different GBAD Methods:

There are various ways to tackle GBAD:

  • Community-Based Approaches (35.9%): They focus on spotting unusual user groups within the network. Fraudsters tend to stick together.
  • Probabilistic-Based Methods (25.6%): These methods use probability models to uncover anomalies.
  • Structural-Based Techniques (17.9%): They examine the network's structure closely to find anomalies.
  • Compression-Based Approaches (10.3%): These methods use data compression techniques to unveil anomalies.
  • Decomposition-Based Approaches (10.3%): They break down the network to identify anomalies.

Evaluation Measures in Anomaly Detection:

How do we know if our anomaly detection system is doing a good job? We have some handy measures:

ANOS ED on dynamic graphs - GCN based approaches. GCN is employed to learn node embeddings from the temporal graph at each timestamp. The attention-based GRU generates the current hidden state using the node embeddings and previous hidden states. The edge scoring function, such as a FCN, is learned to assign anomaly scores, and the top-k edges are depicted as anomalies.
  • Receiver Operating Characteristic (ROC) Curves: These are like the report cards for our models. They're good for binary problems, but they get a bit tricky when our data is lopsided.
  • Precision-Recall (PR) Curves: When dealing with imbalanced datasets (like in fraud detection), these curves give us a clearer picture of our model's performance.
  • F-Measure: This is the go-to measure for many because it balances precision and recall, a sweet spot for imbalanced data.
  • Accuracy: It's useful but not often the best choice for fraud detection because it favors true negatives, which isn't our main concern in these situations.

Tracking Network Activities Over Time:

Fraudsters are sneaky; they change their tactics over time. To catch them, we need to:

  • Tackle Dynamic Networks: Fraudsters adapt by altering their behavior in evolving networks, making fraud detection a moving target.
  • Think Scalable: Our solutions need to be efficient yet effective. We want to catch fraud fast but without too many false alarms.
  • Stay Robust: Networks change, and data can become sparse. We need robust algorithms that can handle these shifts.
  • Know Your Data: As networks evolve, data characteristics change. Our algorithms must keep up.


As AI continues to shape our digital landscape, its integration with Web3 brings both immense possibilities and intricate challenges. To navigate this transformative frontier successfully, open dialogue and collaborative problem-solving are essential. While the solutions proposed here are not exhaustive, they serve as a catalyst for critical conversations about addressing the challenges posed by AI-generated content.  If you're ready to embark on the journey of intelligent innovation with an AI-powered Web3 solution, don't hesitate to reach out to our experts. Together, we can shape a smarter and more secure digital future.

Next generation threat prevention

Book a Demo

Next generation blockchain threat prevention

Identify patterns and anomalies across blockchains in real-time for proactive mitigation.

Book a Demo
Next generation blockchain threat prevention- Identifies patterns and anomalies across web3 in real-time for proactive mitigation.