Open Access

ARTICLE

Explainable Anomaly Scoring for Ethereum Multisignature Transactions Using Temporal Validation and LightGBM

Usman Mohyud Din Chaudhary¹, Humaira Arshad^1,*, Sajid Iqbal^2,*, Abdullah A. Alaulamie², Muhammad Ahsan Raza³, Abid Iqbal⁴

1 Department of Computer Science, The Islamia University of Bahawalpur, Bahawalpur, Pakistan
2 Department of Information Systems, College of Computer Science and Information Technology, King Faisal University, Al-Ahsa, Saudi Arabia
3 Department of Information Sciences, University of Education, Multan Campus, Lahore, Pakistan
4 Department of Computer Engineering, College of Computer Science and Information Technology, King Faisal University, Al-Ahsa, Saudi Arabia

* Corresponding Authors: Humaira Arshad. Email: ; Sajid Iqbal. Email:

(This article belongs to the Special Issue: Advanced Security and Privacy in Blockchain Systems)

Computers, Materials & Continua 2026, 89(2), 23 https://doi.org/10.32604/cmc.2026.084774

Received 29 April 2026; Accepted 22 June 2026; Issue published 15 September 2026

Abstract

Multisignature (multisig) wallets are fundamental to institutional-grade asset security on the Ethereum blockchain, yet Security Operations Centers (SOCs) currently rely on manual threshold rules to flag anomalous executions. Existing anomaly detection approaches suffer from three methodological deficiencies: (i) reliance on random train-test splits that leak future information, (ii) inclusion of post-hoc execution features unavailable at prediction time, and (iii) absence of cross-architectural benchmarking to justify algorithmic choices. This paper addresses all three gaps through a rigorous LightGBM-based framework that automates and explains SOC heuristics. We frame anomaly detection as post-execution forensic triage, where the model analyzes completed transactions to prioritize SOC alerts. Features including internal_calls and log_count are execution-receipt fields available within seconds of finality, enabling near-real-time operational scoring but not pre-submission prevention. Anomaly labels are operational heuristics calibrated to known execution-complexity signatures; the model learns multivariate interactions beyond these univariate thresholds, as validated by two-level ablation (96.8% AUC retained without gas_limit; 77.2% AUC without all execution features) and prediction-rule correlation analysis (r < 0.6). The framework integrates block-height temporal validation, systematic five-category leakage prevention, and benchmarking against graph neural networks (GraphSAGE, GAT) and deep learning (MLP). The model achieves ROC-AUC 0.9971 (95% CI: 0.9961–0.9980) and F1-Score 0.9739 (95% CI: 0.9691–0.9784), with MCC 0.9690 (95% CI: 0.9638–0.9740), outperforming GraphSAGE (0.9824), GAT (0.9415), and MLP (0.9657) while maintaining 11.5× faster inference than GraphSAGE (0.21 vs. 2.40 ms per transaction).

---

Keywords

---