Skip to main content
SpringerLink
Log in
Book cover

International Conference on Financial Cryptography and Data Security

FC 2017: Financial Cryptography and Data Security pp 248–263Cite as

Exchange Pattern Mining in the Bitcoin Transaction Directed Hypergraph

  • Conference paper
  • First Online:

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10323))

Abstract

Bitcoin exchanges operate between digital and fiat currency networks, thus providing an opportunity to connect real-world identities to pseudonymous addresses, an important task for anti-money laundering efforts. We seek to characterize, understand, and identify patterns centered around exchanges in the context of a directed hypergraph model for Bitcoin transactions. We introduce the idea of motifs in directed hypergraphs, considering a particular 2-motif as a potential laundering pattern. We identify distinct statistical properties of exchange addresses related to the acquisition and spending of bitcoin. We then leverage this to build classification models to learn a set of discriminating features, and are able to predict if an address is owned by an exchange with \(>80\%\) accuracy using purely structural features of the graph. Applying this classifier to the 2-motif patterns reveals a preponderance of inter-exchange activity, while not necessarily significant laundering patterns.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    Terminologically, we can call these hypermotifs or hypergraph motifs, but for simplicity here we will just call them motifs.

  2. 2.

    We include addresses in exactly one intersection, ignoring addresses in only a tail or head of one of the transactions, and also addresses in more than two intersections.

  3. 3.

    Note the similarities of the counts for \(\alpha \) and \(\alpha '\), on the one hand, and \(L_1\) and \(L_2\), on the other, due to isomorphism with respect to the ordering of \(E_1\) and \(E_2\).

  4. 4.

    https://bitcoin.org/en/download.

  5. 5.

    https://www.walletexplorer.com, accessed January 16 2016.

  6. 6.

    Recall that this is at the address level, and each exchange has a set of addresses they own. The frequency of each exchange (e.g. BTC-e.com) in STBs is shown in Fig. 10 in the Appendix, and is highly correlated with the number of addresses each exchange has, see Fig. 11.

  7. 7.

    All experiments were run using Python 2.7 and the scikit-learn and numpy packages.

  8. 8.

    For an address a, siblings are addresses that have been a co-input or co-output, successors are addresses that have been an output when a was an input, and predecessors are addresses that were an input when a was an output.

References

  1. Anti-money laundering programs for money services businesses, 31 C.F.R. § 1022.210

    Google Scholar 

  2. Compliance and exemptions, and summons authority, 31 U.S.C. §5318

    Google Scholar 

  3. Ausiello, G., Franciosa, P.G., Frigioni, D.: Directed hypergraphs: problems, algorithmic results, and a novel decremental approach. ICTCS 2001. LNCS, vol. 2202, pp. 312–328. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45446-2_20

    Chapter  Google Scholar 

  4. FATF: Virtual currencies key definitions and potential AML/CFT risks. Technical report (2014)

    Google Scholar 

  5. Gallo, G., Longo, G., Pallottino, S.: Directed hypergraphs and applications. Discret. Appl. Math. 42, 177–201 (1993)

    Article  MathSciNet  MATH  Google Scholar 

  6. Kondor, D., Pósfai, M., Csabai, I., Vattay, G.: Do the rich get richer? an empirical analysis of the bitcoin transaction network. PloS one 9(2), e86197 (2014)

    Article  Google Scholar 

  7. Li, X.-L., Liu, B.: Learning from positive and unlabeled examples with different data distributions. In: Gama, J., Camacho, R., Brazdil, P.B., Jorge, A.M., Torgo, L. (eds.) ECML 2005. LNCS, vol. 3720, pp. 218–229. Springer, Heidelberg (2005). https://doi.org/10.1007/11564096_24

    Chapter  Google Scholar 

  8. Liu, B., Lee, W.S., Yu, P.S., Li, X.: Partially supervised classification of text documents. In: ICML, vol. 2, pp. 387–394. Citeseer (2002)

    Google Scholar 

  9. McPherson, M., Smith-Lovin, L., Cook, J.M.: Birds of a feather: homophily in social networks. Ann. Rev. sociol. 27, 415–444 (2001)

    Article  Google Scholar 

  10. Meiklejohn, S., Pomarole, M., Jordan, G., Levchenko, K., McCoy, D., Voelker, G.M., Savage, S.: A fistful of bitcoins: characterizing payments among men with no names. In: Proceedings of the 2013 conference on Internet measurement conference. pp. 127–140. ACM (2013)

    Google Scholar 

  11. Milo, R., Shen-Orr, S., Itzkovitz, S., Kashtan, N., Chklovskil, D., Alon, U.: Network motifs: simlpe building blocks of complex networks. Science 298, 824–827 (2002)

    Article  Google Scholar 

  12. Möser, M., Böhme, R., Breuker, D.: An inquiry into money launder tools in the bitcoin ecosystem. In: eCrime Researchers Summit, 6–24. Springer, Heidelberg (2013)

    Google Scholar 

  13. Möser, M., Böhme, R., Breuker, D.: Towards risk scoring of bitcoin transactions. In: Böhme, R., Brenner, M., Moore, T., Smith, M. (eds.) FC 2014. LNCS, vol. 8438, pp. 16–32. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44774-1_2

    Google Scholar 

  14. Ober, M., Katzenbeisser, S., Hamacher, K.: Structure and anonymity of the bitcoin transaction graph. Future Internet 5(2), 237–250 (2013)

    Article  Google Scholar 

  15. Reid, F., Harrigan, M.: An analysis of anonymity in the bitcoin system. In: Altshuler, Y., Elovici, Y., Cremers, A., Aharony, N., Pentland, A. (eds.) Security and Privacy in Social Networks, pp. 197–223. Springer, New York (2013)

    Chapter  Google Scholar 

  16. Ron, D., Shamir, A.: Quantitative analysis of the full bitcoin transaction graph. In: Sadeghi, A.-R. (ed.) FC 2013. LNCS, vol. 7859, pp. 6–24. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39884-1_2

    Chapter  Google Scholar 

  17. U.S. Department of the Treasury, FinCEN: FinCEN fines ripple labs Inc.: First Civil Enforcement Action Against A Virtual Currency Exchanger. May 2015. https://www.fincen.gov/news/news-releases/fincen-fines-ripple-labs-inc-first-civil-enforcement-action-against-virtual

Download references

Acknowledgements

This material is based on work supported in part by the Department of Energy National Nuclear Security Administration under Award Number(s) DE-NA0002576. It is also supported in part under the Laboratory Directed Research and Development Program at the Pacific Northwest National Laboratory, a multi-program national laboratory operated by Battelle for the U.S. Department of Energy.

Author information

Authors and Affiliations

  1. North Carolina State University, Raleigh, USA

    Stephen Ranshous & Nagiza F. Samatova

  2. Pacific Northwest National Laboratory, Seattle, WA, USA

    Cliff A. Joslyn, Sean Kreyling, Curtis L. West & Samuel Winters

  3. Oak Ridge National Laboratory, Oak Ridge, USA

    Nagiza F. Samatova

  4. Pacific Northwest National Laboratory, Richland, USA

    Kathleen Nowak

Authors
  1. Stephen Ranshous
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Cliff A. Joslyn
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Sean Kreyling
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Kathleen Nowak
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Nagiza F. Samatova
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Curtis L. West
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Samuel Winters
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Stephen Ranshous .

Editor information

Editors and Affiliations

  1. Leibniz Universität Hannover, Hannover, Germany

    Michael Brenner

  2. New Jersey Institute of Technology, Newark, New Jersey, USA

    Kurt Rohloff

  3. New York University, New York, New York, USA

    Joseph Bonneau

  4. University of Illinois at Urbana-Champaign, Urbana, Illinois, USA

    Andrew Miller

  5. University of Luxembourg, Luxembourg, Luxembourg

    Peter Y.A. Ryan

  6. University of Melbourne, Parkville, Victoria, Australia

    Vanessa Teague

  7. University of Stirling, Stirling, United Kingdom

    Andrea Bracciali

  8. University of Trento, Trento, Italy

    Massimiliano Sala

  9. University of Trento, Trento, Italy

    Federico Pintore

  10. Agari Inc., San Mateo, California, USA

    Markus Jakobsson

Appendices

A Exchanges Used

Fig. 10.
figure 10

Frequency of exchanges in STBs.

Full size image
Fig. 11.
figure 11

Relationship between the number of vertices owned by each exchange and the frequency of that exchange in STBs.

Full size image

B Features Used

An address’ feature matrix is composed of the following features, extracted from each day of the data and then aggregated. Features prefixed with “*” are those removed in the second experiment, where exchange label based features are removed.

  1. 1.

    \(total\_bitcoin\_received\) – How much BTC the address received from transaction outputs over the full time window.

  2. 2.

    \(total\_bitcoin\_spent\) – How much BTC the address spent as transaction inputs over the full time window.

  3. 3.

    \(bitcoin\_balance\) – Total bitcoin received minus total bitcoin spent.

  4. 4.

    \(num\_predecessors\) – How many unique addresses have been an input to transactions where this address was an output.

  5. 5.

    \(num\_transaction\_outputs\) – How many times this address has been used in a transaction output.

  6. 6.

    \(num\_successors\) – How many unique addresses have been an output in transactions where this address was an input.

  7. 7.

    \(num\_transaction\_inputs\) – How many times this address has been used as a transaction input.

  8. 8.

    \(num\_siblings\) – How many unique addresses have been co-inputs or co-outputs with this address.

  9. 9.

    *\(num\_predecessor\_exchanges\) – How many unique exchange addresses have been an input to transactions where this address was an output.

  10. 10.

    *\(num\_successor\_exchanges\) – How many unique exchange addresses have been an output in transactions where this address was an input.

  11. 11.

    *\(num\_sibling\_exchanges\) – How many unique exchange addresses have been co-inputs or co-outputs with this address.

  12. 12.

    \(num\_gamma\_patterns\) – How many times this address is part of a \(\gamma \) pattern.

  13. 13.

    \(num\_beta\_patterns\) – How many times this address is part of a \(\beta \) pattern.

  14. 14.

    \(num\_L1\_patterns\) – How many times this address is part of an \(L_1\) pattern.

  15. 15.

    \(num\_L2\_patterns\) – How many times this address is part of an \(L_2\) pattern.

  16. 16.

    \(num\_alpha\_patterns\) – How many times this address is part of a \(\alpha \) pattern.

  17. 17.

    \(num\_alphaprime\_patterns\) – How many times this address is part of a \(\alpha '\) pattern.

  18. 18.

    reciprocity – How many of this addresses successors are also predecessors.

  19. 19.

    \(anti\_reciprocity\) – How many of this addresses predecessors are also successors.

We focused on local features that are fast to compute. Examples of more expensive but potentially very useful features are explained in [13], e.g. peeling chains or coinbase transactions.

Rights and permissions

Reprints and permissions

Copyright information

© 2017 International Financial Cryptography Association

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Ranshous, S. et al. (2017). Exchange Pattern Mining in the Bitcoin Transaction Directed Hypergraph. In: Brenner, M., et al. Financial Cryptography and Data Security. FC 2017. Lecture Notes in Computer Science(), vol 10323. Springer, Cham. https://doi.org/10.1007/978-3-319-70278-0_16

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-70278-0_16

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-70277-3

  • Online ISBN: 978-3-319-70278-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation