Bitcoin and Cybersecurity: Temporal Dissection of Blockchain Data to Unveil Changes in Entity Behavioral Patterns

Abstract

The Bitcoin network not only is vulnerable to cyber-attacks but currently represents the most frequently used cryptocurrency for concealing illicit activities. Typically, Bitcoin activity is monitored by decreasing anonymity of its entities using machine learning-based techniques, which consider the whole blockchain. This entails two issues: first, it increases the complexity of the analysis requiring higher efforts and, second, it may hide network micro-dynamics important for detecting short-term changes in entity behavioral patterns. The aim of this paper is to address both issues by performing a “temporal dissection” of the Bitcoin blockchain, i.e., dividing it into smaller temporal batches to achieve entity classification. The idea is that a machine learning model trained on a certain time-interval (batch) should achieve good classification performance when tested on another batch if entity behavioral patterns are similar. We apply cascading machine learning principles—a type of ensemble learning applying stacking techniques—introducing a “k-fold cross-testing” concept across batches of varying size. Results show that blockchain batch size used for entity classification could be reduced for certain classes (Exchange, Gambling, and eWallet) as classification rates did not vary significantly with batch size; suggesting that behavioral patterns did not change significantly over time. Mixer and Market class detection, however, can be negatively affected. A deeper analysis of Mining Pool behavior showed that models trained on recent data perform better than models trained on older data, suggesting that “typical” Mining Pool behavior may be represented better by recent data. This work provides a first step towards uncovering entity behavioral changes via temporal dissection of blockchain data.

An Empirical Analysis of Pool Hopping Behavior in the Bitcoin Blockchain

“…We posited the assumption that miners should receive a mining reward (input address) from the mining pool and keep it in their wallet (miner address) before spending it (output address) on services (e. g. exchange, mixer, or marketplace). We used a known entity dataset from WalletExplorer.com with entity type classification from Zola et al [27]. We report the percentage of addresses and Bitcoin values for each entity type in Table II.…”

EOS.IO blockchain data analysis

“…Baumann et al [41] found that over time, the degree distribution of Bitcoin converges to become a scale-free network. F. Zola et al [42] developed a method for entity classification in Bitcoin. They compared the similarities of physical transaction patterns over time and studied whether they repeated certain transaction patterns in different batches of Bitcoin transaction data.…”

Generative Adversarial Networks for Bitcoin Data Augmentation

“…This platform represents a database where information about known entities and their related addresses are stored. This database is continuously updated and has been used as a "ground truth" for many Bitcoin-related studies, such as [2], [33], [24]. Here, Wallet-Explorer data were divided into six classes:…”

“…This calls for novel approaches that can augment the dataset of such critical services with synthetically created instances, ultimately aiming to improve classification results. The most common technique currently adopted to address the imbalance problem is to not consider certain classes [33], or to apply various types of sampling methods, like over-sampling for the least represented classes [11] or undersampling for the most represented ones [18].…”