ART: A Graph-based Framework for Investigating Illicit Activity in Monero via Address-Ring-Transaction Structures
This work addresses the problem of investigating criminal activities in privacy-preserving blockchains for law enforcement agencies, but it is incremental as it builds on existing flagged data and represents an initial partial step.
The paper tackles the challenge of detecting illicit activity in Monero, a privacy-focused cryptocurrency, by proposing a graph-based method that extracts structural and temporal patterns from known criminal transactions and uses machine learning to identify similar behaviors, achieving detection capabilities as a first step.
As Law Enforcement Agencies advance in cryptocurrency forensics, criminal actors aiming to conceal illicit fund movements increasingly turn to "mixin" services or privacy-based cryptocurrencies. Monero stands out as a leading choice due to its strong privacy preserving and untraceability properties, making conventional blockchain analysis ineffective. Understanding the behavior and operational patterns of criminal actors within Monero is therefore challenging and it is essential to support future investigative strategies and disrupt illicit activities. In this work, we propose a case study in which we leverage a novel graph-based methodology to extract structural and temporal patterns from Monero transactions linked to already discovered criminal activities. By building Address-Ring-Transaction graphs from flagged transactions, we extract structural and temporal features and use them to train Machine Learning models capable of detecting similar behavioral patterns that could highlight criminal modus operandi. This represents a first partial step toward developing analytical tools that support investigative efforts in privacy-preserving blockchain ecosystems