How CryptoGuard works
CryptoGuard is an end-to-end portfolio project: a heterogeneous Graph Attention Network trained to flag illicit Bitcoin transactions in the Elliptic++ dataset, wired up to a real graph database and model registry rather than a static notebook.
Data
Elliptic++ extends the original Elliptic dataset with wallet-address-level features and transaction↔wallet edges. Nodes are Transaction and Wallet; edges are SENDS_TO, INPUT_OF, and OUTPUT_TO. ~2% of labeled transactions are illicit, so the model is evaluated on illicit-class precision/recall/F1 and PR-AUC — never accuracy.
Model
A 2-layer heterogeneous GAT (PyTorch Geometric) with weighted cross-entropy for class imbalance, evaluated against a logistic-regression baseline and tracked in MLflow with full params, per-epoch metrics, and a registered model version — see /experiments for real numbers.
Serving
FastAPI loads the MLflow registry's champion alias once at startup. Scoring a transaction fetches its real induced k-hop neighbourhood from Neo4j and runs live GAT inference on it — the same subgraph shape the model saw during training, with attention weights surfaced for explainability.
Caveats
This is a portfolio project, not production AML software. The dataset's illicit rate drops sharply between the training and test time windows, which caps precision for any model trained this way — a real, documented limitation of Elliptic++, not a bug. Neo4j AuraDB Free also hard-caps a database at 200,000 nodes, less than Elliptic++'s 203K transactions alone, so this live graph holds a sampled 140K transactions + 55K wallets rather than the full dataset — the stats above reflect that sampled graph honestly, not the full local dataset size.