The Bitcoin network is a complex network that records anonymous financial transactions while encapsulating the relationships among its pseudonymous users. This paper proposes graph mining techniques to explore the relationships among wallet addresses (pseudonyms for Bitcoin users) suspected to be involved in a given extortion racket, exploiting the anonymity of the Bitcoin network to collect and launder money. Starting around Bitcoin addresses of potential interest, neighborhood subgraphs are analyzed in terms of path length and confluence to detect suspicious Bitcoin flow and other wallet addresses controlled by the suspected perpetrators. We show with a dataset of the Ashley Madison blackmail campaign from August 2015 how the mechanisms can be used both to estimate the amount of money that was extorted by the suspected perpetrators under the specific blackmail campaign, and also estimate the amount of money handled by them during the same period of time.
We showcase a graph mining tool, BiVA, for visualization and analysis of the Bitcoin network. It enables data exploration, visualization of subgraphs around nodes of interest, and integrates both standard and new algorithms, including a general algorithm for flow based clustering for directed graphs, and other Bitcoin network specific wallet address aggregation mechanisms. The BiVA user interface makes it easy to get started with a basic visualization that gives insights into nodes of interests, and the tool is modular, allowing easy integration of new algorithms. Its functionalities are demonstrated with a case study of extortion of Ashley Madison data breach victims.
Given a graph, the notion of entropic centrality was introduced by Tutzauer to characterize vertices which are important in the sense that there is a high uncertainty about the destination of an atomic flow starting at them, assuming that at each hop, the flow is equally likely to continue to any unvisited vertex, or to be terminated there. We generalize this notion of entropic centrality to non-atomic flows, and furthermore show that the case of a non-atomic flow splitting with equal probability across different subsets of edges results in the same entropic centrality as that of the atomic flow. This gives a new and more generalized interpretation to the original entropic centrality notion. Finally, we demonstrate using network graphs derived from Bitcoin transactions that depending on the graph characteristics, the presented entropy based centrality metric can provide a unique perspective not captured by other existing centrality measures -particularly in identifying vertices with relatively low out-degrees which may nevertheless be connected to hub vertices, and thus can have high spread in the network.
Summary Distinct transactions among different and unrelated users are combined together to create a single Bitcoin transaction (mixing transaction) to obfuscate the relationships among the actual participants (more specifically, the wallet addresses used for the transactions). We consider multi‐input multi‐output transactions with at least two inputs and three outputs as proxy, to analyze four characteristic periods of ∼50 days each, representing periods before the introduction of mixing, in its early days, during its growth, and after the volume of such multi‐input multi‐output transactions became more or less stabile. Structural properties and characteristics of the transaction and wallet address networks are computed and compared, through standard tools, but also via the introduction of two novel techniques that provide indicators of mixing‐like behaviors: (1) an entropy characterization to detect abnormally uniform inputs and/or outputs and (2) a connected component analysis of subgraphs formed by only multi‐input multi‐output transactions (showing cascades of such transactions). The contributions of this exploratory Bitcoin network analysis paper can thus be seen as two‐fold. At a macroscopic level, the growth and stabilization periods are shown to stand out with respect to most considered metrics, while at a microscopic level, chains of multi‐input multi‐output transactions, and transactions with outlier behavior in terms of input/output entropies are identified for further investigation.
The notion of entropic centrality measures how central a node is in terms of how uncertain the destination of a flow starting at this node is: the more uncertain the destination, the more well connected and thus central the node is deemed. This implicitly assumes that the flow is indivisible, and at every node, the flow is transferred from one edge to another. The contribution of this paper is to propose a split-and-transfer flow model for entropic centrality, where at every node, the flow can actually be arbitrarily split across choices of neighbours. We show how to map this to an equivalent transfer entropic centrality set-up for the ease of computation, and carry out three case studies (an airport network, a cross-shareholding network and a Bitcoin transactions subnetwork) to illustrate the interpretation and insights linked to this new notion of centrality.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.