An Illicit Bitcoin Address Analysis Scheme Based on Subgraph Evolution

Abstract

Bitcoin, due to its decentralization and anonymity, is more frequently utilized in cybercrimes such as money laundering, darknet market, and blackmail. In order to maintain the development of cryptocurrency communities, it is vital to fight against these cryptocurrency-related (e.g., Bitcoin) cybercrimes. To better monitor cryptocurrency-based cybercrime, it is essential for a deeper understanding of the patterns that exist in Bitcoin transactions. In this paper, we propose a novel framework consisting of empirical analysis and machine learning-based analysis for studying three typical categories of Bitcoin addresses from a dynamic perspective of subgraph evolution. Specifically, we collect 22,001 continuous blocks to build a Bitcoin transaction graph and extract subgraphs from the constructed graph for each address in different periods. In the empirical analysis, we have several important findings from three perspectives. While in the machine learning-based analysis, we propose a 110-dimensional feature set for classification tasks among these three types of Bitcoin addresses, where decision tree, k-nearest neighbor algorithm, and random forest are applied. The experimental results illustrate that metrics of all classifiers can achieve 0.88, and the highest accuracy rate reaches 0.95 in the random forest classifier. In addition, we explore the feature importance in the random forest using the SHAP library and discuss several interesting phenomena that appear in the evolution process of the subgraphs.