A study has investigated the use of process mining in conjunction with blockchain data analysis to enhance suspicious activity detection.
Researchers analyzed transaction data to identify hidden patterns and irregularities indicative of unethical practices, including black market activity and price manipulation.
The study highlights gaps in blockchain governance models and how audit, supported by process and data analytics, can help address them.
What are blockchains?
Blockchains are decentralized digital ledgers which record data (typically transactions) in cryptographically signed immutable blocks linked in a chain, the researchers wrote. The technology is designed to allow trust in anonymous counterparties without intermediaries, often glossed with the term ‘trustless.’
Combining blockchain with process mining
The paper is a practical investigation of both the potential for abuse in blockchain-based financial trading systems and the inbuilt transparency required to expose it. It investigates how blockchain-based process mining can discover patterns of suspicious trading activity in a blockchain-based trading game.
The novel use of process mining tools in this setting employs them as an auditor or regulator might, not as final proof of disruptive or illegal market activity, but as one form of evidence for this behavior by a market participant, building a case that could lead to sanction or regulatory penalties.
This public analysis of suspicious trading is not usually possible for institutional financial markets, such as the New York Stock Exchange, because a full set of counterparty and individual asset identifiers are available only to regulators, if at all, according to the study authors.
Register for All Access: Process Intelligence and Process Mining 2026!
Detecting suspicious behavior with blockchain-based process mining
Process mining was used to produce models of typical Cryptokitties (a non-fungible token (NFT) game first published on the Ethereum blockchain in November 2017) lifecycles and trading patterns across the entire population, and for selected cohorts such as genetic clones and highly traded assets. Social network analysis helped pinpoint exceptional and suspicious trading and holding patterns for these assets.
Early investigation focused on getting models of typical lifecycle behavior and sanity checking them against the CryptoKitties smart contract and descriptions of its intended operation. This allowed the investigation of possible exceptions and edge cases. As in an audit, once individual cases of interest were identified, they were cross-checked for patterns of suspicious behavior.
The researchers we were able to demonstrate suspicious trading behaviors more precisely than otherwise possible on public data or in the existing literature. This suggests that, with the right analytic tools, broader market oversight by a wider range of organizations is possible with blockchain technology, even while several suspicious trading behaviors were discovered in practice. The research also illustrates issues in current governance models by revealing violations of stated market rules.
“Overall, this study helps show more concrete ways transparent ledgers can combine with time-aware analytics to surface suspicious behavior in multi-organization and adversarial environments,” the authors concluded. “Future work might build new process mining tools and concepts that instrument and extend these capabilities.