Detecting artificial behaviours in the Bitcoin users graph

Abstract

A unique feature of cryptocurrencies such as Bitcoin is that the blockchain containing all the economic transactions is publicly available. This makes it possible to obtain insights in the behaviour of the users through an analysis of the topological properties of the users graph which is derived from the Bitcoin transaction graph through clustering heuristics. In a previous work, we have analysed the users graph and discovered that the graph is not a small world, due to the presence of outliers in the in-degree frequency distribution of the nodes and of a high diameter, in spite of a small average distance between the nodes of the graph. In this paper, we explain our findings, showing that these structural properties of the network are due to peculiar unusual patterns in the users graph. As a further remark, we argue that these patterns are probably due to artificial users behaviours and not strictly related to normal economic interactions.

Introduction

The boost in the diffusion, during the last years, of Bitcoin [1], the first true digital currency, together with the public availability of its blockchain makes it interesting and feasible to analyse the behaviour of the users of this peculiar economy. Even if Bitcoin still represents a niche economy, it is no longer an experimental currency only for computer science specialists, and has reached a widespread usage. Therefore, the analysis of its blockchain may return interesting insights on the behaviour of the users of a cryptocurrency.

The novelty of the users graph derived from the Bitcoin blockchain is that nodes represent pseudonymous users and a link between nodes represents an economic interaction, i.e. a flow of value between nodes. Interesting analyses of the Bitcoin ecosystem start from an analysis of this graph. Further interesting findings may be obtained through an integration of this analysis with that of further social networks [2]. For instance, analyzing the sentiment of opinions and information distributed on Twitter regarding Bitcoin and comparing with BitcoinâÇÖs price, can be used to check if there is a correlation between Twitter sentiment and BTC price fluctuation. Other works have pointed out the strong correlation between BitcoinâÇÖs price and the search of the “bitcoin” term, calculated by Google Trends [3].

Our previous work [4] analysed several properties of the Bitcoin users graph. In particular, we showed that the graph presents many feature characteristics of the small-world phenomenon, but also some odd behaviours. As a matter of fact, while the average distance between nodes is low, the graph presents a high value of the diameter. This highlights the presence of few pairs of nodes connected by long paths only. Furthermore, the in-degree frequency distribution of the nodes presents some relevant outliers. As power law degree sequences and small diameter are well-established requirements [5] for complex networks in general to assess the small-world and scale-free phenomena, we argue that it is interesting to study these anomalies of our network and the reasons behind them. A possible explanation is that the odd behaviors are caused by users exploiting Bitcoin not only for ordinary transactions, but rather for other activities, like fund management and, possibly, attacks, as stated in our following Conjecture.

Conjecture 1

(a) The indegree frequency distribution anomalies and (b) the high diameter are caused by uncommon artificial users behavior¹ rather than being inherent properties of the system.

Our paper supports this conjecture and our analysis show that these behaviours are a consequence of particular anomalous chains of transactions, which we call suspicious transactions. A (α, k)-suspicious transaction is such that the only input address pays all the output addresses, which are at least k, α BTC except at most one, which can be the recipient of an arbitrary amount. We show that special combinations of suspicious transactions, called pseudo-spam transactions, are the sole cause of indegree frequency distribution anomalies and can be further agglomerated in just one cluster each, lowering the diameter length and hence obtaining a much shorter diameter. We remark how these so called suspicious transactions are not “suspicious” by themselves, i.e. they might very well be the result of normal users activity. They were labeled as such because they appeared during both our manual observations presented in Section 3 and because they become interesting when combined together in long chains.

This paper extends our previous work  [6] in several directions:

• we investigate a further unusual characteristic of the Bitcoin users graph, i.e. the presence of a high value of the graph diameter. We investigate the reason of such anomalous value by showing that it is due to unusual transaction patterns. These transactions share some of the features of the patterns previously detected during the indegree outliers analysis, so we derive from the general definition of suspicious transactions a definition for the transaction patterns that cause the high diameter;

• we give the Definition of (α, k)-suspicious transaction that enables to unify the description of the different interesting transaction patterns. The entire paper has been consequently restructured;

• we extend both the related work and the discussion on the economical meaning of the interesting patterns.

The paper is organized as follows. In Section 2 we show some related work. In Section 3 we report our observations. In Section 4, we present interesting transaction schemes, introducing the concept of suspicious-transactions, and we discuss their economical meaning in Section 5. Section 6 shows how these transaction schemes can be used to explain our empirical observations. Finally, Section 7 reports our conclusions and future work.