Decentralised Finance (DeFi) applications involve a large volume of funds and exhibit diverse user behaviours, including malicious activities such as smart contract exploits and financial scams. Existing approaches struggle to capture complex behaviours. To address this gap, we propose a general Blockchain User Behaviour Analysis (BUBA) pipeline for DeFi security. The pipeline presents an automated action formation process that takes blockchain transactions as inputs and outputs user actions. In