Transductive vs. Inductive Graph Learning for Illicit Bitcoin Transaction Detection

Abstract

The Bitcoin transaction network represents a complex, high-dimensional system where the pseudonymous nature of flows facilitates ransomware extortion and money laundering activities. However, existing detection methodologies predominantly rely on local transaction features, failing to capture structural dependencies and topological obfuscation techniques used in ransomware and laundering. To address this limitation, this study proposed a hybrid Graph-Based Machine Learning (GBML) framework that integrates structural embeddings (Node2Vec) with ensemble classifiers and contrasts them against inductive GraphSAGE architectures using the Elliptic dataset. The analysis revealed that the Node2Vec-enhanced Random Forest model achieved an F1-score of 0.9277 and a ROC-AUC of 0.9956, substantially outperforming feature-only baselines. Furthermore, the inductive GraphSAGE model demonstrated remarkable robustness under a strict temporal split, achieving an F1-score of 0.8981 on future unseen transactions. This performance improvement is attributed to the encoding of neighborhood context and temporal dynamics, which exposes latent connections between illicit entities. Distinct from purely black-box deep learning approaches, this framework incorporates latent space visualization and permutation-based feature importance to ensure the forensic interpretability required for legal compliance. Consequently, the proposed method provides a robust solution for post-hoc forensic investigations in environments characterized by extreme class imbalance and evolving criminal patterns.