TEMPER: Capturing Consistent and Fluctuating TEMPoral User Behaviour for EtheReum Phishing Scam Detection

Phishing scams on the Ethereum network have become a serious threat, especially with the influx of new users into the cryptocurrency market. Current detection methods are mainly focused on long-term consistent transaction patterns with smooth temporal dynamics. However, these methods often struggle to differentiate between phishing and non-phishing users, whose behaviours may appear deceptively similar. Additionally, they face challenges such as network sparsity and data leakage, leading to significant performance limitations. To address these issues, we introduce TEMPER, a novel sequential learning framework designed to jointly capture the subtle distinctions between long- and short-term user behaviours and their correlations to provide more comprehensive insights. TEMPER effectively generates distinguishable user embeddings, enabling the accurate identification of phishing users. Unlike previous approaches, TEMPER mitigates data leakage through a novel sequential transaction sampling algorithm and addresses network sparsity with short-term temporal learning. Through extensive experimentation on three real-world Ethereum datasets, TEMPER demonstrates its efficacy by achieving a 3-4% improvement in the F1-Score compared to existing baseline models, representing a significant advancement in Ethereum phishing user detection.