AML detection in blockchain systems

A comprehensive final-year research project developing an Anti-Money Laundering (AML) detection mechanism for decentralized blockchain systems. This project demonstrates methodical investigation approaches, threat pattern analysis, and security monitoring techniques - skills directly applicable to cybersecurity analysis. The system implements multiple ML/AI approaches to identify known money laundering patterns and validates detection effectiveness on real blockchain networks, showcasing how structured threat detection methodologies can be applied to complex security challenges.

Research Poster

Below is the visual research poster presented for this final-year project, which summarizes the methodology, key findings, and contributions of the AML detection system.

Poster Overview

The research poster visually presents the comprehensive four-phase methodology used to develop and validate the AML detection system. It highlights:

• Research Framework: The systematic approach from testnet development through mainnet validation to advanced AI techniques
• Technical Architecture: Visual representation of the ML/AI pipeline including feature extraction, model training, and pattern detection
• Key Results: Performance metrics and detection rates across different blockchain networks
• Historical Case Studies: Visual analysis of real-world money laundering cases including Bitfinex, PlusToken, and Ronin Bridge
• Contributions: The project's impact on blockchain AML research and practical applications

The poster demonstrates the project's scope, from initial pattern-based detection algorithms to advanced Graph Neural Networks and LSTM implementations, providing a comprehensive overview of the research journey and outcomes.

Project Overview

This experimental study investigates AML techniques in blockchain systems and develops a pattern-based detection mechanism. The system analyses transaction patterns across Ethereum and TRON (TRC-20) networks to identify money laundering activities including fanout, layering, and mixing techniques.

Research Objectives

The project aims to:

• Study existing AML techniques for blockchain systems
• Implement detection algorithms based on known money laundering patterns
• Evaluate ML/AI approaches (Random Forest, Neural Networks, GNN, LSTM, Autoencoders)
• Validate detection mechanisms on real blockchain networks
• Analyse historical money laundering cases (Bitfinex 2016, PlusToken 2019, Ronin Bridge 2022)

Project Goals

What We Want to Build:

An advanced AML detection system that can:

• Identify money laundering patterns in blockchain transactions in real-time
• Detect known laundering techniques: fanout, layering, mixing, and money mule networks
• Provide risk scoring for addresses and transactions
• Analyse historical cases to validate detection effectiveness
• Compare performance across different blockchain networks (Ethereum and TRON)

Target Outcomes:

• Production-ready detection system with documented methodology
• Comparative analysis of ML/AI approaches for blockchain AML
• Validation against real-world historical cases
• Framework applicable to multiple blockchain networks

Methodology: Four-Phase Approach

The project follows a systematic four-phase methodology, with Phase 1 completed, Phase 2 in progress, and Phases 3 and 4 planned for completion.

Phase 1: Testnet AI Development

Status: Completed

Objective: Build and test ML/AI detection algorithms on Ethereum Goerli testnet

What Was Done:

• Developed pattern-based detection following known money laundering techniques
• Extracted 50+ features from transaction patterns including:
  • Transaction frequency and velocity
  • Amount patterns and distributions
  • Network topology metrics
  • Temporal patterns
  • Address clustering characteristics
• Implemented multiple ML models:
  • Random Forest: Baseline classification for pattern detection
  • Neural Networks: Deep learning approach for complex pattern recognition
  • Ensemble Systems: Combining multiple models for improved accuracy

Results Achieved:

• Established baseline detection performance
• Validated feature extraction methodology
• Confirmed pattern-based approach effectiveness on testnet
• Created foundation for mainnet deployment

Phase 2: Mainnet Validation

Status: In progress

Objective: Validate detection mechanism on Ethereum mainnet with real transactions

What Was Done:

• Deployed detection system on Ethereum mainnet with controlled amounts ($50–100)
• Compared pattern-based AML system against commercial tools
• Measured real-world detection rates for known laundering patterns
• Evaluated false positive rates and system performance

Key Findings:

• Pattern-based approach identified known laundering techniques effectively
• Detection rates comparable to commercial solutions
• System demonstrated ability to identify fanout and layering patterns
• Low false positive rate achieved with proper tuning

Phase 3: Advanced AI Techniques

Status: In progress

Objective: Implement cutting-edge AML detection methods

Planned Implementation:

1. Graph Neural Networks (GNN)

   • Will analyse transaction graph structures
   • Will identify money mule networks and complex laundering schemes
   • Will detect suspicious network topologies
   • Will map relationships between addresses and transactions

2. LSTM (Long Short-Term Memory) Networks

   • Will perform temporal pattern detection
   • Will conduct sequence analysis of transaction flows
   • Will enable time-series prediction for suspicious activity
   • Will capture long-term dependencies in transaction sequences

3. Autoencoders

   • Will enable anomaly detection through reconstruction error
   • Will utilise unsupervised learning for unknown patterns
   • Will identify novel laundering techniques
   • Will detect deviations from normal transaction behaviour

Expected Impact: Advanced techniques will improve detection of complex, multi-stage laundering operations that traditional ML approaches may miss.

Phase 4: Historical Case Analysis

Status: Planned

Objective: Test detection mechanism against real-world historical cases

Planned Case Studies:

1. Bitfinex Hack 2016

   • Will analyse $72 million theft and subsequent laundering
   • Will trace transaction flows through blockchain
   • Will evaluate detection system's ability to identify patterns retrospectively
   • Will validate system against known laundering paths

2. PlusToken Scam 2019

   • Will analyse $2.9 billion cryptocurrency scam
   • Will conduct complex laundering network analysis
   • Will perform multi-blockchain transaction tracking
   • Will test system on large-scale laundering operations

3. Ronin Bridge Hack 2022

   • Will analyse $625 million theft
   • Will perform rapid laundering pattern analysis
   • Will evaluate real-time detection capability
   • Will test system response to fast-moving laundering schemes

Expected Results: Detection system will demonstrate practical applicability by successfully identifying laundering patterns in historical cases.

Technical Implementation

Technologies Used

• Python: Core development language
• SQL: Transaction data storage and querying
• Machine Learning Libraries: Scikit-learn, TensorFlow, PyTorch
• Blockchain Analysis: Web3.py, TronPy
• Data Visualisation: Matplotlib, Plotly, Splunk integration
• Graph Analysis: NetworkX, DGL (Deep Graph Library)

Key Features

• Pattern Recognition: Identifies fanout, layering, mixing, and other known techniques
• Real-time Monitoring: Continuous analysis of blockchain transactions
• Risk Scoring: Generates risk scores for addresses and transactions
• Network Analysis: Maps money mule networks and laundering structures
• Historical Analysis: Retrospective analysis of past laundering cases

Research Questions

The project addresses the following research questions:

1. What AML techniques are most effective for blockchain systems?

   • Comparing traditional ML, deep learning, GNN, and autoencoder approaches
   • Evaluating performance across different pattern types

2. How effective is pattern-based detection compared to anomaly detection?

   • Measuring detection rates and false positive rates
   • Comparing against commercial solutions

3. How do detection rates vary across different blockchain networks?

   • Ethereum vs TRON (TRC-20) comparison
   • Network-specific feature engineering impact

4. What are the performance characteristics of different ML/AI approaches?

   • Speed, accuracy, interpretability trade-offs
   • Resource requirements and scalability

Current Status

Completed Work:

Phase 1 (Testnet AI Development) has been successfully completed. This phase established the foundation of the detection system, validated the pattern-based approach, and demonstrated effectiveness on testnet environments.

In Progress:

Phase 2 (Mainnet Validation) is currently in progress. This phase involves deploying the detection system on Ethereum mainnet with real transactions and comparing performance against commercial tools.

In Progress:

Phase 3 (Advanced AI Techniques) is currently in progress. This phase involves implementing Graph Neural Networks, LSTM networks, and Autoencoders to enhance detection capabilities for complex laundering operations.

Planned:

Phase 4 (Historical Case Analysis) is planned for future implementation. This phase will validate the system against real-world historical cases including the Bitfinex hack, PlusToken scam, and Ronin Bridge hack.

Contributions

This project contributes to the field of blockchain AML by:

• Comprehensive Evaluation: First study comparing multiple ML/AI approaches for blockchain AML
• Real-world Validation: Testing on actual mainnet transactions and historical cases
• Pattern-based Methodology: Systematic approach to detecting known laundering techniques
• Cross-network Analysis: Comparison of effectiveness across different blockchain networks
• Practical Framework: Deployable detection system with documented limitations and best practices

Relevance to Cybersecurity Analysis

This project demonstrates skills essential for cybersecurity analysts working with threat detection and security monitoring:

• Threat Pattern Analysis: Understanding attack techniques and malicious behavior patterns - similar to how cybersecurity analysts identify attack signatures and develop detection rules
• Data Analysis and Investigation: SQL and Python proficiency for analyzing security logs, network traffic, and system events - core skills for methodical security investigations
• Risk Assessment: Developing metrics and scoring systems to prioritize security threats - directly applicable to threat modeling and risk prioritization
• Problem-solving: Breaking down complex detection challenges into manageable components - essential for structured security investigations
• Technical Implementation: Building practical detection and monitoring systems - aligns with developing monitoring tools for infrastructure protection
• Research Methodology: Systematic approach to validation and testing - critical for evaluating security controls and detection effectiveness
• Threat Detection: Identifying malicious patterns in large datasets - directly applicable to developing SIEM rules and security alerts

Future Work

Beyond the four-phase methodology, future enhancements include:

• Integration with traditional banking AML systems
• Real-time alert generation and case management
• Expansion to additional blockchain networks (Bitcoin, BSC, Polygon)
• Development of explainable AI for regulatory compliance
• Collaboration with financial institutions for validation
• Performance optimisation for large-scale deployment