The recent emergence of cryptocurrencies has added another layer of complexity in the fight towards financial crime. Cryptocurrencies require no central authority and offer pseudo-anonymity to its users, allowing criminals to disguise themselves among legitimate users. On the other hand, the openness of data fuels the investigator's toolkit to conduct forensic examinations. This study focuses on the detection of illicit activities (e.g., scams, financing terrorism, and Ponzi schemes) on cryptocurrency infrastructures, both at an account and transaction level. Previous work has identified that class imbalance and the dynamic environment created by the evolving techniques deployed by criminals to avoid detection are widespread in this domain. In our study, we propose Adaptive Stacked eXtreme Gradient Boosting (ASXGB), an adaptation of eXtreme Gradient Boosting (XGBoost), to better handle dynamic environments and present a comparative analysis of various offline decision tree-based ensembles and heuristic-based data-sampling techniques. Our results show that: (i) offline decision treebased gradient boosting algorithms outperform state-of-the-art Random Forest (RF) results at both an account and transaction level, (ii) the data-sampling approach NCL-SMOTE further improves recall at a transaction level, and (iii) our proposed ASXGB successfully reduced the impact of concept drift while further improving recall at a transaction level.

The DoD's next generation UHF SATCOM system, the Mobile User Objective System (MUOS), utilizes a 3G cellular WCDMA waveform in which satellites function as the cell towers. The system's large 5MHz channel bandwidth makes it necessary to be able to "lock out" frequencies with existing legitimate RF network traffic to avoid causing interference to these other users, a process called "notching." To evaluate the method of terminalbased scanning followed by notching for detected user nets, we first reduce RF spectrum analyzer collection campaign data then develop a model to test the effectiveness and efficiency of a WCDMA scan-thennotch spectral etiquette algorithm. Real-world analyzer data is first filtered for half duplex network activity and its hold and interarrival time statistics. The statistics help define the persistence, or dwell, of dynamic WCDMA spectral notches at net frequencies. Using simulated trial runs against the reduced analyzer data, the algorithm is evaluated for its effectiveness in protecting the nets and in preserving the WCDMA link. The relative costs and benefits of the scan-then-notch algorithm are considered in a summary analysis.