RansomCoin: A New Dataset for Analysing Cryptocurrency Transactions - Addressing a Gap in the Literature

Abstract

This paper presents a ransomware payment transactions repository, RansomCoin, and showcases the pattern analysis to understand the behaviour of ransomware attackers' money laundering tactics. The surge in ransomware attacks globally is an exciting research challenge and needs a sustainable solution. In this work, we created a bitcoin transaction dataset related to ransomware. In particular, we have focused on Qlocker, Medusa-Locker, BitPaymer, DarkSide, and Netwalker ransomware attacks to create an automation process that extracts data associated with these attacks from the blockchain. The automation details are publicly available via GitHub. The RansomCoin dataset will help law enforcement agencies trace the transaction and analyse the bitcoin movements in the blockchain. The dataset contains suspicious/normal flags, which can help focus on the wallet address flagged as suspicious. The k-NN algorithm from the family of anomaly detection techniques performs better in identifying suspicious transactions.