Submit

Login Login

Register Register

Home / Journals / CMC / Online First / doi:10.32604/cmc.2026.084774
Journal Menu
Special Issues
Table of Content

All issues

Online First

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Open Access

ARTICLE

Explainable Anomaly Scoring for Ethereum Multisignature Transactions Using Temporal Validation and LightGBM

Usman Mohyud Din Chaudhary1, Humaira Arshad1,*, Sajid Iqbal2,*, Abdullah A. Alaulamie2, Muhammad Ahsan Raza3, Abid Iqbal4
1 Department of Computer Science, The Islamia University of Bahawalpur, Bahawalpur, Pakistan
2 Department of Information Systems, College of Computer Science and Information Technology, King Faisal University, Al-Ahsa, Saudi Arabia
3 Department of Information Sciences, University of Education, Multan Campus, Lahore, Pakistan
4 Department of Computer Engineering, College of Computer Science and Information Technology, King Faisal University, Al-Ahsa, Saudi Arabia
* Corresponding Author: Humaira Arshad. Email: email; Sajid Iqbal. Email: email
(This article belongs to the Special Issue: Advanced Security and Privacy in Blockchain Systems)

Computers, Materials & Continua https://doi.org/10.32604/cmc.2026.084774

Received 29 April 2026; Accepted 22 June 2026; Published online 21 August 2026

Abstract

Multisignature (multisig) wallets are fundamental to institutional-grade asset security on the Ethereum blockchain, yet Security Operations Centers (SOCs) currently rely on manual threshold rules to flag anomalous executions. Existing anomaly detection approaches suffer from three methodological deficiencies: (i) reliance on random train-test splits that leak future information, (ii) inclusion of post-hoc execution features unavailable at prediction time, and (iii) absence of cross-architectural benchmarking to justify algorithmic choices. This paper addresses all three gaps through a rigorous LightGBM-based framework that automates and explains SOC heuristics. We frame anomaly detection as post-execution forensic triage, where the model analyzes completed transactions to prioritize SOC alerts. Features including internal_calls and log_count are execution-receipt fields available within seconds of finality, enabling near-real-time operational scoring but not pre-submission prevention. Anomaly labels are operational heuristics calibrated to known execution-complexity signatures; the model learns multivariate interactions beyond these univariate thresholds, as validated by two-level ablation (96.8% AUC retained without gas_limit; 77.2% AUC without all execution features) and prediction-rule correlation analysis (r < 0.6). The framework integrates block-height temporal validation, systematic five-category leakage prevention, and benchmarking against graph neural networks (GraphSAGE, GAT) and deep learning (MLP). The model achieves ROC-AUC 0.9971 (95% CI: 0.9961–0.9980) and F1-Score 0.9739 (95% CI: 0.9691–0.9784), with MCC 0.9690 (95% CI: 0.9638–0.9740), outperforming GraphSAGE (0.9824), GAT (0.9415), and MLP (0.9657) while maintaining 11.5× faster inference than GraphSAGE (0.21 vs. 2.40 ms per transaction).

Keywords

Blockchain security; multisignature governance; operational anomaly detection; SOC automation; temporal validation; LightGBM; graph neural networks; SHAP explainability

  • 138

    View

  • 21

    Download

  • 0

    Like

Related articles
Copyright© 2026 Tech Science Press
© 1997-2026 TSP (Henderson, USA) unless otherwise stated

Share Link