Research / evaluation record

Graph-based feature engineering for DeFi security incident severity prediction

Published research followed by a stricter, reproducible evaluation of what the available graph evidence supports.

Authors

Daria Pavlova
Inna Novalija
Dunja Mladenić

Venue

Information Society 2025
Slovenian KDD Conference
Ljubljana, Slovenia

Access

Reported conference result

0.598 → 0.787

AUC reported by the 2025 paper using the archival conference profile.

Corrected chronological holdout

0.823 / 0.817

Baseline / graph-enriched AUC under the timestamp-safe portfolio profile.

Research question

Does protocol context known before a DeFi security incident improve the ranking of incidents by severe financial loss?

The corrected experiment narrows the question to facts whose availability at prediction time can be demonstrated. Retrospective graph structure is not silently treated as historical evidence.

System view

Figure 01

One dataset. Two model variants.

01 Shared data

Incident dataset

One dataset, shared baseline inputs and the same preprocessing.

02 Model comparison

Baseline

Shared inputs

Graph-enriched

Shared inputs + timestamp-eligible graph features

03 Evaluation

Temporal validation

Chronological holdout and expanding-window cross-validation.

Identical splits for both models

Both models receive the same baseline inputs and deterministic LightGBM configuration. The enriched model adds only timestamp-eligible graph features.

Method

  1. Build the corrected dataset from 1,608 normalized incidents dated 2011–2025.
  2. Split observations chronologically at 2023-07-28 and fix the severe-loss threshold from the training period.
  3. Require every graph feature to have an availability timestamp no later than the incident.
  4. Evaluate a chronological holdout and five expanding-window temporal folds.

Results

Chronological holdout

AUC on the held-out period

Baseline0.823
Graph-enriched0.817

Temporal cross-validation

Mean AUC ± standard deviation · 5 folds

Baseline0.775
Graph-enriched0.787
ModelHoldout AUCF1PrecisionRecallTemporal CV AUC
Baseline0.8230.5450.6110.4910.775 ± 0.090
Graph-enriched0.8170.5130.6200.4380.787 ± 0.074

Baseline

Holdout AUC
0.823
F1
0.545
Precision
0.611
Recall
0.491
Temporal CV AUC
0.775 ± 0.090

Graph-enriched

Holdout AUC
0.817
F1
0.513
Precision
0.620
Recall
0.438
Temporal CV AUC
0.787 ± 0.074
Interpretation

Graph enrichment did not improve the chronological holdout. Temporal CV was slightly higher on average, but variance and threshold sensitivity prevent a strong predictive claim.

Limits

  • Three structural graph features are excluded because their historical availability is undocumented.
  • Public incident coverage is incomplete and reported losses may be noisy or revised.
  • Raw source records are not redistributed because redistribution rights have not been established.
  • This is a research artifact, not a deployed risk-scoring or financial decision system.

Other research

01 record