Illicit transaction identification

Abstract

A computer implemented method of generating a restructured graph-based dataset (100b) of transactions within a public ledger, the method comprising: providing an original graph-based dataset (100a) of transactions within a public ledger, the original graph-based dataset (100a) comprising nodes (102, 104, 106) and edges (110, 112); determining a relatedness score for each of a plurality of pairs of nodes (102, 104, 106) in the original graph -based dataset (100a); and for each of the pairs of nodes (102, 104, 106): comparing the relatedness score to a threshold; and updating the original graph-based dataset (100a) to include a new edge (114) between the pair of nodes (102, 104, 106) if the relatedness score exceeds the threshold.

Description

[0001] ILLICIT TRANSACTION IDENTIFICATION FIELD OF THE INVENTION The present invention relates to methods for identifying illicit transactions within public ledger data, and particularly methods for training graph neural networks (GNNs) to identify illicit transactions. BACKGROUND In recent years there has been a dramatic increase in the use of blockchain networks and the number of crypto-asset transactions that are being conducted on them. This increase has been accompanied by an increase in the amount of criminal activity that is being conducted on and through these blockchains. Transaction anonymity and a lack of regulatory oversight has enabled sophisticated cybercriminals to launder stolen funds through multiple cryptocurrency networks, resulting in tens of millions of dollars in losses to enterprises and end users. Illicit activity on cryptocurrency networks also extends beyond financial crime; the ability to transmit ‘money’ without the use of financial intermediaries means that cryptocurrencies such as Bitcoin have been used for terrorist financing, human trafficking and darknet transactions for drugs, weapons and other illegal goods and services. Efforts have been made to tackle illicit transactions on blockchains. In general, authorities would like to understand cryptocurrency transactions and currency flow between address / wallets / users of the blockchain. Currently, there are heuristic tools deployed on blockchains that aim to identify illicit transactions and / or addresses. Given the networked nature of blockchains and cryptocurrency transactions, there is interest in using graph neural networks (GNNs) to identify illicit activities. By mapping transaction data as a graph, GNNs may be used to navigate the graph-based data, identifying transactions / addresses that are connected with known illicit transactions and funds, with the aim of following illicit transaction flows through the network. However, real-world transaction data is often highly imbalanced. This may be due to quantity imbalance (i.e., the disproportionate ratio of labelled nodes in the data ), but also the topology imbalance that arises due to uneven structural properties of labelled nodes in the graph. This imbalance makes training of GNNs for identifying illicit transactions within blockchains challenging. Firstly, if the labelled nodes are placed far apart in the graph, there may be little or no signal being passed between them, making the GNN a poor learner. Secondly, irrelevant (noisy) edges between the nodes make the exchanged signal between nodes inferior, resulting in a weak learner. These issues are made more difficult by active attempts to launder illicit funds by routing transactions through many blockchain addresses, which further obscures transaction flows and reduces the signal between nodes. Therefore, although there is interest in using GNNs to identify illicit transactions within blockchains (and other related public ledger / networked applications), this approach faces practical challenges due to inherent characterist ics of the underlying data. There is a desire to improve the training of GNNs, in order to improve their robustness and precision in this context. SUMMARY According to a first aspect of the invention, there is provide d a computer implemented method of generating a restructured graph-based dataset of transactions within a public ledger. The method comprises: providing an original graph-based dataset of transactions within a public ledger, the original graph-based dataset comprising nodes and edges; determining a relatedness score for each of a plurality of pairs of nodes in the original graph-based dataset; and for each of the pairs of nodes: comparing the relatedness score to a threshold; and updating the original graph-based dataset to include a new edge between the pair of nodes if the relatedness score exceeds the threshold. The original graph-based dataset may be any suitable dataset containing data regarding transactions within a public ledger. The dataset may be a publicly or commercially available dataset from a third party. The dataset may comprise data that a user themselves has collated. Generating the restructured graph-based dataset may improve the effectiveness with which illicit nodes can be identified within the dataset when using a graph neural network (GNN) classification approach. The new edge (s) may improve the connection between nodes (i.e., the signal between nodes within the graph). Where nodes are only weakly connected in the original graph-based dataset, the new edges may enhance the connection between nodes. This may improve the robustness of the GNN. Restructuring the graph-based dataset may be used to address issues associated with imbalanced datasets. Datasets related to public ledger transactions (e.g., cryptocurrency blockchain transactions) are often highly imbalanced. Firstly, the number of label led nodes within the data, for example the number of nodes (transactions) labelled as illicit, may be very small, due to the large number of transactions being conducted and difficulties in identifying / tracking illicit transactions on the public ledger. Se condly, the graph-based dataset may be topologically imbalanced due to uneven structural differences between the nodes. Updating the graph-based dataset to include new edges may improve the effectiveness with which a GNN can be applied to imbalanced data. The new edges may enable further connections between unlabelled nodes and labelled nodes than can be achieved using only the original graph-based dataset. A greater number of unlabelled nodes may be able to be classified as the signal between labelled and unlabelled nodes is improved. Nodes that are relatively far apart from each other on the graph may be connected via the new edges. This may enable classification and identification of nodes that are poorly connected in the original dataset (e.g., nodes wit h few connections or are at the periphery of the graph). Determining the relatedness score for each of the plurality of pairs of nodes may comprise: identifying a node labelled as illicit in the original graph -based dataset; and for each of a plurality of other nodes in the original graph-based dataset, computing a connectivity metric of the other node to the node labelled as an illicit node. The connectivity metric may provide a score for how well any two nodes are connected within the graph. The connectivity metric may be dependent upon the topology of the graph and the existing edges between said nodes – two nodes that neighbour one another and have an edge connecting them may have a greater connectivity metric than two nodes that are relatively far apart and only connected via several intermediaries. The connectivity metric between a node labelled as illicit and another node may provide an indication that the other node is also an illicit node. The other node may not be labelled in the original graph-based dataset. The original graph-based dataset may be updated to include new edges between the node labelled as illicit and each of a predetermined number of other nodes with the greatest connectivity metrics. The new edges may connect the illicit node to one or more other node. The original graph-based dataset may not include an edge between the illicit node and the one or more other nodes. The new edge may therefore increase how connected the illicit node is to the other node. New edges may be created between the illicit node and k other nodes with the greatest connectivity metric. The k parameter may be a fixed or adjustable parameter (e.g., 100 new edges may be created), or k could be dependent on a variable of the original graph-based dataset (e.g., the number of new edges may be a certain percentage of the number of existing edges). Alternatively, a threshold could be applied to the connectivity metric, such that a new edge is created for all other nodes with a connectivity metric to the illicit node that is greater than a threshold value. Computing the connectivity metric may comprise calculating a probability of a random walk along edges in the original graph-based dataset going from the node labelled as illicit to each of the other nodes. The random walk may hop randomly between nodes along edges in the original graph-based dataset. The connectivity metric may be indicative of how likely it is that the random walk will reach a given node starting from a node labelled as illicit. Nodes that neighbour the illicit node or are separated by only a few intermediary nodes may be more likely to be reached via the random walk, and thus may have a higher connectivity metric. Calculating the probability of the random walk along edges in the original graph -based dataset going from the node labelled as illicit to each of the other nodes may comprise applying a graph diffusion matrix function to the original graph -based dataset. The graph diffusion matrix function may be a Personalized PageRank function , for example. The function may assign a weight to each random walk depending on the likelihood that the random walk ends at a given node. The new edge may aggregate the path of a random walk. For example, a random walk may, starting from a node labelled as illicit, pass through several intermediary nodes before terminating at the other node, the random walk being along the edges that connect said nodes. The signal along these edges from the illicit node to the final other node may be relatively weak. However, the new edge which connects the illicit node to the final other node may increase the signal / connectivity between the two. The method may further comprise: identifying all nodes labelled as illicit in the original graph -based dataset; and for each of the plurality of other nodes in the original graph-based dataset, computing a connectivity metric of the other node to each node labelled as illicit. Where the original graph-based dataset comprises a plurality of nodes labelled as illicit, a connectivity metric may be calculated for other nodes relative to each of the plurality of nodes labelled as illicit, or a subset thereof. It is possible that nodes may have a high connectivity metric to more than one illicit node. A random walk function as described above may be performed starting from each of the plurality of nodes labelled as illicit. The plurality of other nodes in the original graph-based dataset may comprise all nodes in the original graph-based dataset, other than nodes labelled as illicit. Therefore, a connectivity metric may be computed for all other nodes in the graph (i.e., all nodes that are not labelled as illicit). Combined with considering all nodes labelled as illicit as described above, this may mean that all other nodes are provided with a co nnectivity metric for all of the illicit nodes in the network. Connectivity metrics may only be computed for a subset of the nodes in the original graph-based dataset. For example, connectivity metrics may not be computed for nodes that are labelled as lic it or illicit. I.e., a connectivity metric may only be computed for nodes that are not labelled. These may be nodes that are of most interest / importance, as a user may wish to classify these unlabelled nodes as licit or illicit. Although described above in relation to computing a connectivity metric for a node relative to a node labelled as illicit, the same process could be applied to nodes labelled as licit in the original graph-based dataset. For example, a random walk could begin at a licit node. The connectivity metric may therefore be indicative of how likely it is that the other node is a licit node. Both illicit node and licit node connectivity metrics could be computed and compared for an original graph-based dataset. The comparison could be used as a further validation. A node that has a high illicit node connectivity metric and a low licit node connectivity metric may be more likely to be an illicit node than a node that is well connected to both illicit and licit nodes, for example. Determining the relatedness score for each of a plurality of pairs of nodes may comprise: identifying a corresponding characteristic for each node of each pair of nodes; and for each pair of nodes, computing a similarity metric for the identified corresponding characteristic of the pair of nodes. The corresponding characteristic may be a local feature of each node. Where the original graph-based dataset relates to cryptocurrency transactions on a blockchain, the local feature of each node may be an amount of currency involved in the transaction, a number of inputs / outputs for the transaction, a fee associated with the transaction (e.g., some currency in the transaction going to a third-party payment provider), an output volume, and aggregated figures such as an average currency received by the inputs / outputs, or an average number of incoming or outgoing transactions associated with the inputs / outputs. The corresponding characteristics may be an aggregated feature of each node, which may be obtained using transaction information one-hop backward / forward from the node in question. Computing the similarity metric may comprise applying a neural network to the original graph-based dataset, thereby generating an embedded representation of features for e ach node. The embedded representation of features may comprise a vector representing the features of each node. The embedded representation may have a reduced dimensionality compared to the original feature information. Computing an embedded representation may reduce the computation required to assess similarity between nodes. The neural network may be a two-level perceptron network. Other neural network architectures capable of comparing features in order to provide a classification may be used instead. Computing the similarity metric for the identified corresponding characteristic of the pair of nodes may comprise applying a sigmoid function to the embedded representation of the features of each node. The output of the sigmoid function may be used to determine if a new edge should be generated between a pair of nodes based on the similarity of their features. The similarity metric may be computed for all possible pairs of nodes in the original graph-based dataset. Alternatively, only a subset of node pairs may be considered. For example, a similarity metric may be computed for each pair of nodes comprising a node labelled as illicit, for example. Based on the similarity metric, it may be determined whether a new edge should be created between any two nodes. New edges may be created between pairs of nodes that have a similarity metric above a certain threshold. The number of new edges may be limited to a certain amount (i.e., only k new edges may be added). The same corresponding characteristic may be used to compute all of the similarity metrics. For example, a transaction amount for each node may be compared for each pair of nodes, such that all nodes have their transaction amount compared. Multiple characteristics may be compared for all or some of the modes. The multiple characteristics may be used to generate a plurality of similarity metrics, or the similarity metrics may be aggregated and / or averaged. For example, the similarity metric may represent a comparison of two nodes’ similarity in both transaction amount and number of input / outputs. Certain characteristics may be weighted more heavily. For example, the transaction amount may provide a stronger indication of similarity than the number of input / outputs, and therefore may have a stronger influence on the connectivity metric. The same corresponding characteristic may not be used to compute all of the similarity metrics; some pairs of nodes may rely upon other characteristics t han other pairs. This may be used to provide a similarity metric for nodes that have missing or incomplete feature data. For example, a first characteristic may be used to compute the similarity metrics for the majority of nodes, but a second characteristic may be used to compute the similarity metric for a subset of nodes that are missing data on the first characteristic. Updating the original graph-based dataset may comprise updating an original adjacency matrix of the original graph-based dataset, the updated adjacency matrix comprising an entry corresponding to the new edge. The original graph-based dataset may comprise the original adjacency metric or this may be calculated based on the original graph. Where a new edge is created, the associated adjacency matrix may be updated to reflect the new edge. Updating the original graph-based dataset may comprise updating an original adjacency matrix such that the updated adjacency matrix does not include an entry for an edge between a pair of nodes whose relatedness score does not exceed the threshold. The original adjacency matrix / original graph-based dataset may contain an edge between a pair of nodes. However, the method may determine that the pair of nodes are not well connected / related; the connectivity metric and / or the similarity metric may be below a certain threshold. Therefore, the adjacency metric may be updated to delete said edge. This may be used to eliminate ‘noisy’ edges within the dataset, i.e., for nodes that are only weakly connected. Each of the nodes in the original graph-based dataset may represent a transaction recorded on the public ledger and each of the edges may represent a flow of currency associated with the transactions. The public ledger may be a blockchain network and the transactions may be cryptocurrency transactions. The methods described herein could be applied to Bitcoin networks and transaction data, for example. At least some of the nodes within the restructured graph-based dataset may be labelled with an existing label associated with a corresponding node in the original graph -based dataset. For example, all of the nodes labelled as illicit in the original graph -based dataset may be labelled as illicit in the reconstructed graph-based dataset. Some of the nodes may not be provided with a corresponding existing label. For example, where it is determined that a licit node has a low relatedness score, the licit node may be updated to be an unknown or unlabelled node in the reconstructed graph -based dataset. According to a second aspect of the present invention, there is provided a computer implemented method of training a graph neural network (GNN) to identify illicit transactions within public ledger data. The method comprises generating a restructured graph-based dataset from an original graph-based dataset, by modifying at least some edges connecting nodes within said original graph-based dataset. Generating the restructured graph-based dataset may be done using a method according to the first aspect. The method of training a GNN further comprises: providing the restructured graph-based dataset to a GNN; and performing supervised training of the GNN using at least part of the restructured graph-based dataset. Where the GNN is to be trained for a specific purpose, the original graph-based dataset may be selected for that purpose. For example, where the GNN is to be trained for identifying illicit cryptocurrency transactions, the dataset may be existing cryptocurrency network transaction data. Using the restructured graph-based dataset may improve the learning of the GNN. Restructuring of the dataset may be considered to be a pre-processing step that can be used to generate better training data. The inclusion of new edges in the restructured graph-based dataset may enable more robust training of the GNN by providing stronger connections between nodes of interest, in particular to nodes labelled as il licit. In particular, by implementing pre-processing followed by training, the trained GNN may be robust at identifying illicit transactions that have been obfuscated. Many criminal organisations will use processes such as mixing to hide or obscure illici t activity. Currency associated with illicit or fraudulent transactions may be moved between many accounts and combined, split up and recombined with currency from lots of different transactions. This mixing can make it difficult to navigate the graph usin g existing methods; the connectivity between an end node and a known illicit node may be weak, meaning that it is difficult to identify the flow of currency from illicit transactions. However, the methods of the present invention may at least partially overcome this by restructuring the graph and providing new edges that enhance these obscured connections. The GNN may comprise a convolutional network architecture. The GNN may be a graph convolutional network (GCN). Supervised training may be performed on a subset of the restructured graph-based dataset associated with a selected time interval of the public ledger data. Although the pre-processing method discussed above describes generating a restructured graph -based dataset from an original graph-based dataset, the skilled person will understand that said datasets may comprise subsets of larger datasets. Different subsets of the same data can be used for training, texting and validating. The larger dataset may contain several time intervals. For example, the larger dataset may comprise multiple graph-based datasets taken from the same network (e.g., blockchain) at different times. Training may be performed using a first graph-based dataset and testing / validation may be performed using a second graph-based dataset. According to a third aspect of the invention, there is provided a computer implemented method of identifying illicit transactions recorded on a public ledger . The method may comprise training a GNN using a restructured graph-based dataset of the GNN may have been trained using a restructured graph-based dataset. The training of the GNN may be done using a method according to the second aspect. The restructured dataset may be generated according to the first aspect. The method of identifying illicit transactions further comprises: providing transaction data to the trained GNN, the transaction data comprising transactions recorded on a public ledger, wherein at least some of the transactions are known illicit transaction; classifying transactions as potentially illicit transactions if they are associated with at least one of the known illicit transactions; and generating a notification comprising a list of the illicit transactions and sending the notification to an authority. The method may further comprise transforming the transaction data into a suitable graph-based form such that it can be analysed by the GNN, if not already in such form. The notification may contain information regarding the illicit transaction . The information may be a feature extracted from a node in the transaction data . The authority may be any entity that is involved in processing, facilitating or overseeing transactions recorded on the public ledger. The authority may be a bank, a payment processor, a currency exchange, a law enforcement body or a regulatory authority, for example. The notification (and any associated information contained therein) may be forwarded by the authority to a second authority. For example, a bank or currency exchange may forward the notification to a law enforcement body. After receiving the notification, the authority may take action to investigate or rectify the illicit transaction, or to prevent further transactions. For example, in the case where the public ledger is a blockchain and transactions are cryptocurrency transactions, the authority may be a cryptoexchange. After being notified that a transaction is potentially illicit (by virtue of being associated with a known illicit transaction), the cryptoexchange may limit or prevent transactions being conducted to or from a cryptowallet associated with the illicit transaction. Therefore, the methods of the present invention may enable effective and automatic anti -fraud mechanisms. Although discussed herein as relating to blockchain and cryptocu rrency applications, the same pre-processing and training methods may be implemented so that a GNN can analyse any graph-based dataset for a public ledger or network in order to identify illicit activity. The methods may be applied to traditional, fiat -based payment systems, for example. The methods may be applied to internet datasets in order to provide traffic analysis, wherein the structure of the internet network and interconnections between websites are represented as a graph. Or, for example, the methods may be applied to social networks, where people / organisations and the interactions between them are represented as a graph. In particular, the pre-processing and training methods may be applied to literature and citation analysis. A database containing topics / fields, research areas or groups, authors, individual papers (for example, journal articles) and citations may be represented as a graph to which these methods may be applied. The nodes of a graph may be journal articles and the edges may be citations therebetween, for example. The methods of the present invention may be used to connect illicit or fraudulent nodes within the citation data. For example, where an ‘illicit’ paper has been found to be incorrect or falsified, the present methods may be used to identify other papers within the network that are related to the illicit paper. The methods of the present invention may be used for non-illicit purposes, for example tracking of ideas and concepts through literature. The term ‘illicit transaction’ may not necessarily mean an ‘illegal monetary transaction’. The term ‘illicit’ may be taken to mean any generally negative data point, such as a journal article that has been shown to contain false information. The term ‘transaction’ may be taken to mean any connection or exchange of data between two entities, such as a literature citation. DETAILED DESCRIPTION Embodiments of the invention will be described, purely by way of example, with reference to the accompanying drawings, in which: Figure 1 shows a flow diagram of Unspent Transaction Output (UTxO)-based transactions; Figure 2 shows an example of transactions being conducted between nodes in a network; Figure 3 shows two separate visualisations of transactions being conducted between nodes in a network; Figure 4 shows a graph of aggregated transaction data; Figure 5 shows a graph of aggregated transaction data that has been restructured using a connectivity-based algorithm; Figure 6 shows a graph of aggregated transaction data with underlying node feature similarity; Figure 7 shows a graph of aggregated transaction data that has been restructured using a node similarity-based algorithm; Figure 8 shows the distribution of labels in a transaction dataset; and Figure 9 shows the results of pre-processing of transaction data used for training several neural network architectures. Transaction graphs In one example, the present invention is used to classify cryptocurrency (for example, Bitcoin) transactions occurring on a blockchain network. Transferring Bitcoin between addresses and executing the movements of output from one sender to another receiver involves the use of an Unspent Transaction Output (UTxO) method. UTxO is an alternative to traditional account-based transactions where a live balance is maintained for every user in the network performing debit and credit operat ions when two users transact. Transactions in the Bitcoin network capture money flow from an originating address to a destination address. Unspent transactions in the network are also known as output transactions that are yet to be spent. A set is updated on the blockchain to keep the network participants up to date on this value. The UTxO set is vital for the validation of transactions on the network. Every originating address is a reference to an UTxO, which is a destination in a previous transaction that has not been referenced in other transactions. Referring to Figure 1, example UTxO transactions are illustrated. A first address A (e.g., a cryptocurrency wallet) has 10 Bitcoin and wishes to send 2 Bitcoin to second address B and 3 Bitcoin to third address C. A first transaction TxAB(UTxO) is initiated as an input, with two outputs – one to address B and another to a change address Ab,with transaction amount 2 and 8, respectively. Next, to send 3 Bitcoins to address C, a new second transaction TxAC is performed from Ab to two outputs, C and another change address AC, with 3 and 5 Bitcoins, respectively. One blockchain user may have many different change wallet addresses. This may make the identification and tracking of users on the network difficult and leaves the network susceptible to illicit activity. As shown in Figure 1, the Bitcoin transaction graph can be represented as a granular network consisting of every input and output and their connections. However, such a graph can become very large with relatively few addresses and / or transactions involved. Referring to Figure 2, basic transaction operations are shown, where inputs 1, 2, and 3 are transacted to create outputs 4, and 5. These are then used as new inputs in two separate transactions to create outputs 6, 7, and 8. The network can be modelled differently, which may reduce computational cost while still capturing the flow of Bitcoin between transactions (and therefore still allowing illicit transactions to be identified). Aggregating the inputs and outputs to a transaction level can reduce the number of nodes by several factors. Referring to Figure 3, the compression factor between a granular input / output level graph (left hand side (a)) versus an aggregated transaction level graph (right hand side (b)) is illustrated. The left-hand diagram (a) shows the connections between the inputs and outputs resulting in 8 nodes with 9 edges. The right-hand graph (b), wherein these transactions are aggregated, contains only 3 nodes and 2 edges. In the input / output level graph, nodes correspond to addresses or accounts and edges correspond to transactions. In the aggregated graph, nodes correspond to transactions and edges correspond to flows of currency (e.g., Bitcoin) between transactions. Topology imbalance in a graph network may occur when some parts of the graph have more nodes and connections than others. In the context of illicit Bitcoin transactions, this may create difficulty in gathering enough useful information from distant nodes to identify illegal activities. Available obfuscation tools, such as mixers, further increase irrelevant information in the network, making it more challenging to trace the original source of funds. In the examples discussed below, aggregated transaction graph data is used (the Elliptic dataset, discussed further below, uses an aggregated transaction graph). Using an aggregated graph in these methods may be preferable due to the reduced number of nodes and edges, and thus reduced computational requirements. However, the methods described can equally be applied to input / output level graphs. In the same way that illicit nodes may correspond to a known illicit transaction in the aggregated graph, an illicit node in the input / output level graph may correspond to a known illicit address / account. The way in which the pre-processing of the graphs is handled shall be the same in both instances. The methods may be applied similarly irrespective of the source of the data. A transaction graph like that discussed above may be represented as ^^ = { ^^, ℰ}, where ^^ represents the graph-based dataset, ^^ is a finite non-empty set also called the vertex or nodes set, and ℰ are the pairs of distinct vertices or edges. ℰ may be empty. Transaction flows on a public ledger (for example, the transaction flows of a cryptocurrency) can be expressed as a graph ^^ ={^^, ℰ}where ^^ is the set of N nodes specified by transactions and ℰ is the edge set denoted by transaction flow between nodes. The graph-based dataset comprises as an adjacency matrix ^^ ∈ and a node feature matrix ^^ ∈ ℝ^^× ^^0. The node feature matrix captures features of each transaction (for example amount, timestamp, etc.), where ^^0denotes the dimension of node attributes. At least some of the nodes are labelled, the labels representing transaction category or address types (namely illicit or licit) and is represented by ^^. In simpler terms, the transaction graph can be represented as graph ^^ =(^^, ^^, ^^). Training of Graph Neural Networks (GNNs) using pre-processed data Graph embedding is a method to represent graph nodes, edges, or sub-graphs in lower dimensional vectors. Combining both graph embedding and convolutional neural networks (CNNs), GNNs aggregate the information from graph structures. GNNs calculate representations of input data in the form of graphs and may aid in the performance of some tasks, such as classification. A key difference between regular neural networks and GNNs is that the data input into a GNN is not independent and contains many relations between the data instances in the form of nodes and edges. Graph Convolutional Networks (GCNs) are a deep learning technique which combine Graph Neural Networks and Convolutional Neural Networks, and may be used for classification in graph datasets. The main difference between a regular convolution seen in a convolutional neural network (CNN) and a GCN is in the operation on the data input. For example, a CNN will convolve across all the pixels in an image. Each pixel aggregates the neighbouring pixels values, and then replaces its original value with this aggregation. These aggregated values are then passed through a neural network layer. The process for a GCN is similar, but instead of pixels, it uses the node of a graph, and aggregates on the neighbouring nodes for an aggregated value before passing these values through a neural network layer. GCNs are similar in theory to label propagation methods, but instead of just using the label and smoothing it across neighbouring nodes, GCNs capture the vital node feature information as well. The issue of identifying illicit nodes within graph-based transaction data can be formulated as a node classification task. Specifically, given a set o f transactions within, for example, a blockchain network, the transaction graph ^^ can be reconstructed based on the underlying properties of the transactions. A GNN can then be trained to predict the probability that transaction nodes are illicit or not. To make robust predictions of illicit nodes (transactions), one has to take not only into account the transaction-specific data or node features but also the structural connections which reflect benign and illicit transaction patterns. Real world data may be noisy, imbalanced, unlabelled, incomplete, and / or error prone, which makes graph -based prediction models less robust. The present invention generally comprises a two-step pipeline consisting of: i) a pre-processing method that produces a reconstructed graph-based dataset, and ii) performing supervised training of a GNN on said reconstructed graph-based dataset. Given the original graph ^^ = ( ^^, ^^, ^^), the pre-processing method produces an optimized / reconstructed graph ^^∗=(^^, ^^∗, ^^), where ^^∗is a learned graph adjacency matrix for the node classification task. Next, the reconstructed graph is used to train a GNN ^^: ^^∗→ ^^ on the node classification task. The pre-processing and training process aims to learn the essential graph properties ^^ (i.e., node interconnections) robust enough for underlying data distribution changes conditioned on the labels at hand. Suppose that ^^ is defined as the summation of ^^^^, the irrelevant properties of the graph, and ^^∗is denoted by ^^ = ^^∗+ ^^^^^^(^^; ^^)= ^^(^^∗; ^^)+ ^^(^^^^; ^^)^^( ^^∗; ^^) = ^^( ^^∗; ^^) + ^^( ^^∗; ^^^^) ^^( ^^∗; ^^^^) = ^^( ^^∗; ^^) − ^^( ^^∗; ^^) Pre-processing methods are discussed below, wherein the reconstructed graph ^^∗is generated from the original graph ^^. In doing so, noise that exists both in node features and their interconnections may be reduced by modifying the connections between nodes (i.e., the original adjacency matrix ^^ is modified to ^^∗). In essence, by reconstructing the graph-based data to include new edges that are determined to have a high relatedness (i.e., between nodes that have good connectivity / similarity) and / or removing edges that are determined to have a low relatedness (i.e., edges that are noisy or unimportant), the GNN can then be trained using data that better represents important features and connections of the graph. This may result in the GNN more robustly learning to classify nodes of interest (e.g., nodes related to illicit transactions). Edges based on Affinity Referring to Figures 4 and 5, the effect of a first pre-processing algorithm on graph-based data is shown. Figure 4 shows a graph 100a of nodes and edges in an original graph-based dataset, while Figure 5 shows a graph 100b of nodes and edges in a reconstructed graph-based dataset following the application of an ‘Edges based on Affinity’ (EA) algorithm. In general, the EA pre-processing algorithm is configured to cycle through each illicit node 102a-c in an original graph-based dataset and calculate a connectivity metric for each other node in that dataset. The other nodes that are most connected to the initial illicit node 102a-c (as determined by the connectivity metric) are selected. A new edge 114 is created in the reconstructed graph-based dataset, the new edge 114 joining the illicit node 102a-c to the high connectivity metric other node 106a. In selecting which other nodes are to form a new edge 114, the connectivity metric may be compared to a designated, adjustable threshold parameter. Alternatively, the k most connected other nodes may have new edges joined to them. The adjacency matrix for the dataset is updated to reflect the reconstructed graph. Any new edges may be added to the adjacency matrix. Edges in the original graph-based dataset may be removed if they are determined to be too ‘noisy’ (i.e., the node they are connected to does not have a high enough connectivity score). As shown in Figure 4, in the original graph 100a of the network, there are a number of illicit nodes 102, licit nodes 104 and unknown / unclassified / unlabelled nodes 106. So me of the nodes are connected by edges 110, while noisy edges 112 exist between some nodes. The boundary 120a for a two-hop signal flow from the unknown node 106a is shown; the unknown node 106a is only connected to a few of the nodes in the graph when considering a two-hop signal. In effect, nodes 102a, 104a, 104b and 106a are separated from the other nodes in the graph by more than two hops; it may consequently be difficult to identify connections between those nodes in the boundary 120a and those outside of it. After the EA algorithm is applied, the reconstructed graph 110b (as shown in Figure 5) includes new edges 114 between the other illicit nodes 102b, 102c of the graph and the unknown node 106a. To do this, the connectivity metric of the unknown nod e 106a will have been calculated and determined to be above a threshold parameter. In doing this, the two-hop signal boundary 120b of the unknown node 106a in the reconstructed graph 100b has been expanded, enabling connections to be established between th e unknown node 106a and the illicit nodes 102 of the graph. Expressing the EA method mathematically, for each node ^^^^in the original graph nodes ^^, the local connectivity influence of the node on the labelled illicit nodes ( ^^^^) is measured. For any node ^^^^: 1. A function ^^(∙,∙)is applied to measure a connectivity metric indicating the connectivity influence / relationship between ^^^^and ^^^^; 2. All nodes with the highest affinity (based on the connectivity metric) to ^^^^are selected; 3. All the new edges between these high affinity nodes and ^^^^are used to create a new adjacency matrix ^^∗. Also, ^^ ∈ [0,1] is used as hyperparameter to adjust the size of the new graph [ ^^ ^^]. The function ^^ may be any suitable graph diffusion matrix method, for example Personalized PageRank (PPR1), and is used to calculate the connectivity influence and relationships between illicit nodes and the rest of the graph. PPR is a graph diffusion matrix technique that involves random walks, where ^^ = ^^ ^^−1, represents the probability of a random walk going from node ^^ to node ^^ in ^^ steps. To summarize EA, the creation process of the new graph is illustrated in the following algorithm: Require: Original graph ^^, the graph containing only labelled illicit nodes at training time and target ratio ^^ ∈[0,1]1: ^^, ^^′← Pick random nodes from ^^ and ^^^′^, respectively 2: for ( ^^^^, ^^^^) ∈{( ^^, ^^), ( ^^′, ^^′)}do 3: ^^^^← Calculate connectivity metric of nodes ^^( ^^^^, ^^^^) 4: ^^^^← Select ^^ nodes having the largest scores in ^^^^5: ^^ ← ^^^^if ^^^^= ^^ otherwise ^^′← ^^^^6: end for Given a node in the labelled set of illicit nodes, the function ^^ propagates a signal from ^^^^to all the nodes in the original graph, and assigns large connectivity score to the nodes close to ^^^^and neighbours with ^^^^. Top ^^ nodes with high scores are selected, and their edges are used to create a new adjacency matrix. Edges based on Node Features Referring to Figures 6 and 7, the effect of a second pre-processing algorithm on graph-based data is shown. Figure 6 shows a graph 100a of nodes and edges in an original graph-based dataset, while Figure 7 shows a graph 100b of nodes and edges in1Lawrence Page, et al. 1999. The PageRank citation ranking: Bringing order to the web. Technical Report. Stanford InfoLab. a reconstructed graph-based dataset following the application of an ‘Edges based on Node Features’ (NF) algorithm. Whereas EA uses connectivity based on the graph properties of the nodes, ENF utilises the underlying features of each node. As shown in Figure 6, in the original graph 100a of the network, there are a number of illicit nodes 102, licit nodes 104 and unknown / unclassified / unlabelled nodes 106. Some of the nodes are connected by edges 110, while noisy edges 112 exist between some nodes. Some nodes have an underlying relationship 116 that is not captured by an existing edge (or at least any connectivity between these nodes is so weak that the nodes are not considered to be connected by an edge – the nodes may be more than two hops apart, for example, resulting in a weak or no signal). Each of the nodes may have features associated with it, for example number of inputs / outputs, output transaction volume, and aggregated figures such as average amount received by the inputs / outputs, and average number of incoming or outgoing transactions associated with the inputs / outputs. The intuition behind ENF is that the quality of edges within the graph is a function of the node features. For example, if a transaction amount is a node feature, then transactions with the same amounts may be interrelated and have a higher probability of forming a new edge 114 than others having different transaction amounts. An embedding or mathematical representation of the node features is generated. This is done using a neural network, such as a two-layer perceptron network. These embeddings are then passed through a function, such as a Sigmoid function, to determine if the features of the nodes are similar enough such that a new edge 114 should be created between said nodes. The probability of forming a new edge between the nodes ^^ and ^^ as a parameterized matrix ^^^^ ^^= { ^^^^ ^^} where and ^^ is learned attention weights from node features that is given by ^^( ^^) = ^^( ^^( ^^)), sigmoid( ^^( ^^) ^^( ^^)T, where ^^( ^^) is the output of ^^(∙) which denotes a two-layer perceptron network to generate node embeddings of input node ^^. ^^^^, ^^indicates the strength of the edge between nodes ^^ and ^^ based on their similarity. The smaller the value, the more likely the edge ( ^^, ^^) is a noisy signal and vice versa. Once the node probability matrix ^^^^ ^^is generated, the elements which are smaller than a threshold ^^ may be masked off. The new symmetric sparse adjacency matrix ^^∗is then generated for the new graph. As shown in the new graph 100b of Figure, the ENF method can be used to generate new edges 114 between nodes that had an underlying similarity 116 in the original graph 100a. Additionally, by thresholding edges based on similarity betwe en nodes, noisy edges 112 in the original graph 100a may be deleted – despite having a noisy edge, the similarity metric calculated using ENF may be below a threshold and thus these edges are removed from the reconstructed graph-based dataset for the new graph 100b. Nodes which were labelled in the original data, for example licit node 104b, may have their labels removed. Identification of illicit transactions Following the generation of the reconstructed graph-based dataset using the pre- processing methods discussed above, the reconstructed graph-based dataset is used to train a graph neural network (GNN) for a node classification task. The trained GNN can then be used to identify illicit transactions. The pre-processing methods were evaluated using a node classification task in order to verify whether the generated reconstructed graphs improve the effectiveness and robustness of multiple GNN classifiers. The performance of the various GNN architectures was compared against a baseline random forest approach using the Elliptic dataset (which was not in graph format when the random forest was trained and tested). Node imbalance techniques were also compared against methods of the present invention on the DBLP (Digital Bibliography & Library Project) citation network dataset. The Elliptic dataset2is a large, labelled cryptocurrency transaction dataset that is available publicly. The features present in the Elliptic Bitcoin (BTC) dataset are deemed proprietary and are not fully disclosed. The dataset is graph-based. The totals nodes in this dataset amount to 203,769 with 166 features associated with each node. There are 234,355 edges. The nodes have been either labelled licit (42,019 nodes or 21%), illicit (4,545 or 2%), or unknown (157,205 or 77%). The labels were informed using a heuristics-based reasoning process. The graph dataset is temporal, and the data can be split over 49 time steps. Of the 166 features, the first 94 represent local information about the transaction. This includes number of inputs / outputs, fees, output volume, and aggregated figures such as average BTC received by the inputs / outputs, and average number of incoming or outgoing transactions associated with the inputs / outputs. The remaining 72 features are aggregated features, which were obtained using transaction information one-hop backward / forward from the center node. This gives the minimum, maximum, standard deviation, and correlation coefficients of the neighbour transactions for the same information data. The Elliptic dataset is just one example of a suitable transaction dataset. Any suitable graph-based dataset may be used. When the methods are to be deployed for fraud detection on a particular network / blockchain, the datasets used for training GNN may comprise transaction data collected from said network / blockchain. The results discussed herein are examples only. The Elliptic Bitcoin dataset was selected for verifying the present invention due to it being the most popular dataset for identifying illicit activity in crypto currency. It is also one of the few publicly available labelled graph cryptocurrency datasets, albeit anonymized, that allows for supervised machine learning and pre -processing experimental techniques to be performed. As shown in Figure 8, the Elliptic dataset is highly imbalanced, with the first 6 time-steps containing less than ten illicit labelled transactions among thousands of nodes. The GNN models were trained on data from the 7−11 time-steps, the model was validated on data from the 12−17 time-steps, and data from 18−49 time-steps was used2Mark Weber, et al. 2019. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics. arXiv (2019). Issue 10. https: / / arxiv.org / abs / 1908.02591 for testing. The Elliptic dataset also contains an external event that resulted in the shutdown of the dark market (from which data was collected) at time step 43. This may lead to GNN performance degradation on subsequent time-step data. The DBLP citation network data is a graph dataset comprising papers represented as nodes and citations as edges. Each node is labelled according to its research domain. The network encompasses diverse topology structures that encode specific paper features, thereby proving valuable for experimental analysis. However, in the DBLP network, distinct topology groups are not readily accessible. Therefore, a similar imbalance setting as described in Chen et al3was used for the validation of the present invention. Again, the results discussed herein are examples only. The same methods may be applied to any other suitable graph-based citation data. The effectiveness of the pre-processing methods on both the Elliptic dataset and the DBLP dataset was compared against other recent imbalanced node classification techniques, such as GraphSMOTE (GSMOTE4), ReNode3, RECT5, and DR-GCN6. For the ENF and EA methods, the Graph Attention Network (GAT – described below) was applied as a backbone model. To analyse the performance of the GNN classifier, the F1-score was calculated. This is a popular method for analysing the performance of a binary classific ation task that has a largely imbalanced dataset (like the Elliptic dataset). The F1-score is the harmonic mean of the recall and precision of a model’s output. Recall is considered a percentage of ground-truth anomalies, which have been classified as anomalies at a given threshold. A recall metric is provided by 3Deli Chen, et al. 2021. Topology-imbalance learning for semi-supervised node classification. Advances in Neural Information Processing Systems 34 (2021), 29885 –29897.4Tianxiang Zhao, et al. 2021. Graphsmote: Imbalanced node classification on graphs with graph neural networks. In Proceedings of the 14th ACM international conference on web search and data mining. 833–841.5Zheng Wang, et al. 2020. Network embedding with completely-imbalanced labels. IEEE Transactions on Knowledge and Data Engineering 33, 11 (2020), 3634 –3647.6Min Shi, et al. 2020. Multiclass imbalanced graph convolutional network learning. In Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence (IJCAI-20). Precision is considered to be the percentage of reported anomalies, which are actually true anomalies. A precision metric is provided by ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ = ^^ ^^ + ^^ ^^ TP, FP and FN correspond to the percentage of true positives, false positives and false negatives respectively. The F1-score is the harmonic mean of both precision and recall , given by The methods of the present invention were compared with baselines using five GNN architectures: GCN7, GAT8, GraphSAGE9, and GPRGNN10and Explore-to-Extrapolate Risk Minimization (EERM11) – a graph out-of-distribution (OOD) detection method with backbone GPRGNN model. A baseline random forest model was also used as a comparison. The testing was performed using the following parameters: For the EA method, ^^ was set to 0.2, and for ^^ function [ ^^ = 0.2, ^^ = 0.1]; For the ENF method, ^^ was set to 1e-5, Random forest – n_estimators of 300, max_features of 2 and min_samples_split of 200; GCN – sequence of 2-layer GCNConv with ReLU as the activation; GAT – sequence of 2-layer GATConv with head number 4 and ELU as the activation; GraphSAGE – sequence of 5-layer SAGEConv and hidden size as 32, ReLU as the activation with ^^^^= 0.0001, ^^^^= 0.0002, ^^ = 1.0, ^^ = 5, ^^ = 1 as hyper parameters; GPRGNN – PPR initialization is used and GPRprop as the propagation unit. The associated hyper-parameters in GPRGNN model ^^^^ ^^ ^^ ^^ ^^ ^^= 0.1, ^^^^= 0.005, ^^^^= 0.01, ^^ = 1.0, ^^ = 5, ^^ = 1; and7Thomas N. Kipf and Max Welling. 2017. Semi-supervised classification with graph convolutional networks. 5th International Conference on Learning Representations, ICLR 2017 - Conference Track Proceedings (2017), 1–14.8Petar Velickovic, et al. 2018. Graph Attention Networks. In International Conference on Learning Representations (ICLR).9William L. Hamilton, et al. 2017. Inductive Representation Learning on Large Graphs. In Advances in Neural Information Processing Systems (NeurIPS). 1024 –1034.10Eli Chien, et al. 2021. Adaptive Universal Generalized PageRank Graph Neural Network. In International Conference on Learning Representations (ICLR).11Qitian Wu, et al. 2022. Handling Distribution Shifts on Graphs: An Invariance Perspective. arXiv preprint arXiv:2202.02466 (2022). EERM – the backbone model has same setup as GPRGNN; ^^ is set to 3, ^^ to 5 and ^^ to 1. For each GNN method, the model was trained with 100 epochs. The following results are the test result achieved at the epoch when each model provides the best performance on the validation set. The EA and ENF pre-processing methods were tested to assess their capability for improving the node classification task. Each experiment was performed with three trial runs. The average test set F1-scores are shown in Table 1 for all five GNN and random forest models. The testing was performed for the timesteps from [34-49] in the data, separated into four intervals. The best results in each model group are underlined and shown in bold. The random forest model which acted as a comparative baseline against the GNN methods, showed high and consistent F1-score when applied to the first 8 time steps. However, Table 1 shows that the model fails to identify any illicit nodes in the final seven time steps, where imbalance of illicit nodes to licit nodes is very high (as shown in Figure 8), due to the aforementioned darknet marketplace shutdown from timestep 43. The random forest performance is in contrast to the performance of all GNN architectures which are capable of identifying at a minimum 40% of the illicit nodes in the same time steps. This may be due to graphs being capable of learning relationships between data points better than the standard tabular machine learning models. Additionally, traditional baselines depend on well -defined data, features, and graph topologies. The methods of the present invention exhibit promising capabilities in real -world settings with imbalanced and missing data. Despite the very small signal in timesteps 43-49, the ENF method successfully identified illicit transactions, demonstrating ability to operate in challenging conditions. The proposed pre-processing methods consistently outperform all baseline models, represented by ^^ (no graph restructuring), by a considerable margin, implying that the graphs generated by EA ( ^^^∗^ ^^) and ENF ( ^^^∗^ ^^ ^^) methods provide better graph structure learning and improve classification quality. Table 1: Summary of node classification results show as the average F1-score across 3 runs. ↑ illustrates an increase in F1-score from the EA and ENF pre-processing. Underlined: best performance of specific GNN models, bold: best results of each window. Referring to Figure 9, the F1-scores across all 9 test folds are shown. As shown in Figure 9, the performance of EA and ENF can vary when different models are adopted. Both GNN architectures GraphSAGE (panel (b)) and GPRGNN (panel (c), can adaptively combine information from node features and graph topology – the ENF method yields higher F1-scores, improving their performance. For the vanilla GCN model (panel (d), the EA method performed better than ENF, indicating that nodes can receive more supervision information on their ground-truth labels by influencing their connectivity to illicit nodes. Similarly, the EERM method combines several augmented views of the graph to maximize the variance of the learned GNN loss. The results are consistently higher when using the ENF method for graph reconstruction than the baseline OOD method. Table 2 shows the results of a second experiment involving the DBLP dataset. I t is evident that the proposed ENF method achieves superior performance compared to all baseline approaches, as reflected in the F1-score. Techniques such as GSMOTE and ReNode, which rely on label propagation mechanisms while neglecting to encode topology structures, were found to be less effective than the methods of the present invention. Table 2: F1-scores of different imbalanced node classification techniques compared to the proposed methods. The methods were tested on the DBLP dataset, and the same test window timesteps of the Elliptic dataset (34-49). To test that the proposed methods, in turn, improve the robustness of the downstream GNNs, edges sampled from the Bernoulli distribution with probability ^^ values [0.2, 0.5, 0.9] were randomly dropped from the original graph, and the F1 -scores measured at test time windows for Graph-SAGE model. As shown in Table 3, the ENF and EA methods consistently outperformed the baselines in each time window, indicating that the pre-processing methods improve the robustness of the downstream GNNs. Scenarios like this are common in the Bitcoin network, where the labelled data is often very sparse, and data is highly temporal with missing context.

[0002] Table 3: F1 scores for test time windows between 18 − 43 with random edges dropped with probability p for GraphSAGE downstream model. ^^^∗^ ^^ ^^was consistently found to perform with high scores across all time windows. Topology / label imbalances in the bitcoin transaction graph may emerge mainly because – (a) advancements in techniques and tools leveraged by cybercriminals in masking their transactions and increasing anonymity decrease the smoothness of transaction graph structure resulting in topology imbalance; and (b) heuristics -based labelling approaches often introduce a high error rate when applied to transaction data and introduce label imbalance. The EA and ENF methods may at least partially address this imbalance problem, which may in turn help to improve overall performance for a variety of multiple GNN architectures. The edges are reconstructed to replace the transactional flow of Bitcoin with the connectedness between nodes and overcome the noise introduced by heuristics labelling and multi-hop visibility limitations of the fraudulent transactions. With the signal from a small set of nodes being propagated across the graph at training time (5 temporal steps (7 − 11)) and validated on (12 − 17 time windows), there was a boost in performance of the trained GNN (temporal steps 18 − 49) without any retraining or changes in architecture. This indicates that : (a) using the pre-processing methods to fix structural properties of the input graph data improves GNN classification performance; and (b) illicit transaction flows in the Bitcoin network have structural similarities, which the methods of the present invention can learn. Although specific examples have been described, the skilled person will appreciate that variations are possible, within the scope of the invention, which should be determined with reference to the accompanying claims.

Claims

CLAIMS 1. A computer implemented method of generating a restructured graph-based dataset of transactions within a public ledger, the method comprising: providing an original graph-based dataset of transactions within a public ledger, the original graph-based dataset comprising nodes and edges; determining a relatedness score for each of a plurality of pairs of nodes in the original graph-based dataset; and for each of the pairs of nodes: comparing the relatedness score to a threshold; and updating the original graph-based dataset to include a new edge between the pair of nodes if the relatedness score exceeds the threshold.

2. The computer implemented method of claim 1, wherein determining the relatedness score for each of the plurality of pairs of nodes comprises: identifying a node labelled as illicit in the original graph-based dataset; and for each of a plurality of other nodes in the original graph -based dataset, computing a connectivity metric of the other node to the node labelled as an illicit node.

3. The computer implemented method of claim 2, wherein the original graph -based dataset is updated to include new edges between the node labelled as illicit and each of a predetermined number of other nodes with the greatest connectivity metrics.

4. The computer implemented method of claim 2 or claim 3, wherein computing the connectivity metric comprises calculating a probability of a random walk along edges in the original graph-based dataset going from the node labelled as illicit to each of the other nodes.

5. The computer implemented method of claim 4, wherein calculating the probability of the random walk along edges in the original graph-based dataset going from the node labelled as illicit to each of the other nodes comprises applying a graph diffusion matrix function to the original graph-based dataset.

6. The computer implemented method of any of claims 2 to 5, further comprising: identifying all nodes labelled as illicit in the original graph -based dataset; andfor each of the plurality of other nodes in the original graph -based dataset, computing a connectivity metric of the other node to each node labelled as illicit.

7. The computer implemented method of any of claims 2 to 6, wherein the plurality of other nodes in the original graph-based dataset comprises all nodes in the original graph-based dataset, other than nodes labelled as illicit .

8. The computer implemented method of claim 1, wherein determining the relatedness score for each of a plurality of pairs of nodes comprises : identifying a corresponding characteristic for each node of each pair of nodes; and for each pair of nodes, computing a similarity metric for the identified corresponding characteristic of the pair of nodes.

9. The computer implemented method of claim 8, wherein computing the similarity metric comprises applying a neural network to the original graph-based dataset, thereby generating an embedded representation of features for each node.

10. The computer implemented method of claim 9, wherein the neural network is a two-level perceptron network.

11. The method of claim 9 or claim 10, wherein computing the similarity metric for the identified corresponding characteristic of the pair of nodes comprises applying a sigmoid function to the embedded representation of the features of each node.

12. The method any of claims 8 to 11, wherein the similarity metric is computed for all possible pairs of nodes in the original graph-based dataset.

13. The computer implemented method of any preceding claim, wherein updating the original graph-based dataset comprises updating an original adjacency matrix of the original graph-based dataset, the updated adjacency matrix comprising an entry corresponding to the new edge.

14. The computer implemented method of any preceding claim, wherein updating the original graph-based dataset comprises updating an original adjacency matrix suchthat the updated adjacency matrix does not include an entry for an edge between a pair of nodes whose relatedness score does not exceed the threshold .

15. The computer implemented method of any preceding claim, wherein each of the nodes in the original graph-based dataset represents a transaction recorded on the public ledger and each of the edges represents a flow of currency associated with the transactions.

16. The computer implemented method of claim 15, wherein the public ledger is a blockchain network and the transactions are cryptocurrency transactions.

17. The computer implemented methods of any preceding claim, wherein at least some of the nodes within the restructured graph-based dataset are labelled with an existing label associated with a corresponding node in the original graph-based dataset.

18. A computer implemented method of training a graph neural network, GNN, to identify illicit transactions within public ledger data, the method comprising; generating a restructured graph-based dataset using the method of any of claims 1 to 17; providing the restructured graph-based dataset to a GNN; and performing supervised training of the GNN using at least part of the restructured graph-based dataset.

19. The computer implemented method of claim 18, wherein the GNN comprises a convolutional network architecture.

20. The computer implemented method of claim 18 or claim 19, wherein supervised training is performed on a subset of the restructured graph-based dataset associated with a selected time interval of the public ledger data.

21. A computer implemented method of identifying illicit transactions recorded on a public ledger, the method comprising: training a GNN using the method of any of claims 18 to 20;providing transaction data to the trained GNN, the transaction data comprising transactions recorded on a public ledger, wherein at least some of the transactions are known illicit transaction; classifying transactions as potentially illicit transactions if they are associated with at least one of the known illicit transactions; and generating a notification comprising a list of the illicit transactions and sending the notification to an authority.

22. The computer implemented method of claim 21, wherein the notification contains information regarding the illicit transaction, the information being associated with a corresponding node labelled as illicit in the restructured graph -based dataset.

Images