Identifying Ransomware Actors in the Bitcoin Network
This addresses the challenge of detecting illegal activities like ransomware payments in Bitcoin, which is crucial for law enforcement and financial security, though it appears incremental as it builds on existing graph analysis methods.
The paper tackled the problem of identifying ransomware actors in the Bitcoin network by analyzing transaction graphs, achieving 85% prediction accuracy in differentiating between ransomware, random, and gambling actors on test data.
Due to the pseudo-anonymity of the Bitcoin network, users can hide behind their bitcoin addresses that can be generated in unlimited quantity, on the fly, without any formal links between them. Thus, it is being used for payment transfer by the actors involved in ransomware and other illegal activities. The other activity we consider is related to gambling since gambling is often used for transferring illegal funds. The question addressed here is that given temporally limited graphs of Bitcoin transactions, to what extent can one identify common patterns associated with these fraudulent activities and apply them to find other ransomware actors. The problem is rather complex, given that thousands of addresses can belong to the same actor without any obvious links between them and any common pattern of behavior. The main contribution of this paper is to introduce and apply new algorithms for local clustering and supervised graph machine learning for identifying malicious actors. We show that very local subgraphs of the known such actors are sufficient to differentiate between ransomware, random and gambling actors with 85% prediction accuracy on the test data set.