TY  - EJOU
AU  - Chaudhary, Usman Mohyud Din 
AU  - Arshad, Humaira 
AU  - Iqbal, Sajid 
AU  - Alaulamie, Abdullah A. 
AU  - Raza, Muhammad Ahsan 
AU  - Iqbal, Abid 

TI  - Explainable Anomaly Scoring for Ethereum Multisignature Transactions Using Temporal Validation and LightGBM
T2  - Computers, Materials \& Continua

PY  - 
VL  - 
IS  - 
SN  - 1546-2226

AB  - Multisignature (multisig) wallets are fundamental to institutional-grade asset security on the Ethereum blockchain, yet Security Operations Centers (SOCs) currently rely on manual threshold rules to flag anomalous executions. Existing anomaly detection approaches suffer from three methodological deficiencies: (i) reliance on random train-test splits that leak future information, (ii) inclusion of post-hoc execution features unavailable at prediction time, and (iii) absence of cross-architectural benchmarking to justify algorithmic choices. This paper addresses all three gaps through a rigorous LightGBM-based framework that automates and explains SOC heuristics. We frame anomaly detection as post-execution forensic triage, where the model analyzes completed transactions to prioritize SOC alerts. Features including internal_calls and log_count are execution-receipt fields available within seconds of finality, enabling near-real-time operational scoring but not pre-submission prevention. Anomaly labels are operational heuristics calibrated to known execution-complexity signatures; the model learns multivariate interactions beyond these univariate thresholds, as validated by two-level ablation (96.8% AUC retained without gas_limit; 77.2% AUC without all execution features) and prediction-rule correlation analysis (r < 0.6). The framework integrates block-height temporal validation, systematic five-category leakage prevention, and benchmarking against graph neural networks (GraphSAGE, GAT) and deep learning (MLP). The model achieves ROC-AUC 0.9971 (95% CI: 0.9961–0.9980) and F1-Score 0.9739 (95% CI: 0.9691–0.9784), with MCC 0.9690 (95% CI: 0.9638–0.9740), outperforming GraphSAGE (0.9824), GAT (0.9415), and MLP (0.9657) while maintaining 11.5× faster inference than GraphSAGE (0.21 vs. 2.40 ms per transaction).
KW  - Blockchain security; multisignature governance; operational anomaly detection; SOC automation; temporal validation; LightGBM; graph neural networks; SHAP explainability

DO  - 10.32604/cmc.2026.084774