Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

O Bitcoin Where Art Thou? An Introduction to Cryptocurrency Analytics

339 views

Published on

An overview of current cryptocurrency analytics methods and tools.

Published in: Data & Analytics
  • You can hardly find a student who enjoys writing a college papers. Among all the other tasks they get assigned in college, writing essays is one of the most difficult assignments. Fortunately for students, there are many offers nowadays which help to make this process easier. The best service which can help you is ⇒ www.WritePaper.info ⇐
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

O Bitcoin Where Art Thou? An Introduction to Cryptocurrency Analytics

  1. 1. O BITCOIN WHERE ART THOU? An Introduction to Cryptocurrency Analytics Dr. Bernhard Haslhofer Oesterreichische Nationalbank (OeNB) | Research Seminar 2018-01-12
  2. 2. 1. Which cryptocurrency should I buy? 2. What do you think about cryptocurrency X? 3. Where can I buy cryptocurrency X? Is it safe? 4. Can you help me setting up a cold wallet? 5. How will the price of cryptocurrency X evolve? MOST FREQUENT QUESTIONS I GET 2
  3. 3. PUBLIC ATTENTION 3
  4. 4. • Cryptocurrencies have entered mainstream • Public opinion is often misinformed and based on insufficient and / or unexamined evidence • Systematic scientific examination of entire cryptocurrency ecosystems still in its infancy • Missing methods, insufficient tool support MOTIVATION Image source: https://www.flickr.com/photos/namecoin/22995486509 4
  5. 5. • Contribute to a better understanding of the structure and dynamics of cryptocurrency ecosystems • Multidisciplinary cooperation to answer specific (research) questions related to cryptocurrencies • Develop scalable quantitative methods, tools and services that help in answering those questions • Micro-level analysis: inspect atomic entities (block, transaction, address, currency flow) • Macro-level analysis: investigate real-world actors and services and their relationships OUR GOALS CRYPTOCURRENCY ANALYTICS 5
  6. 6. INSIGHT INTO CRYPTOCURRENCY ECOSYSTEMS Global De-centralized Transparent Pseudo-Anonymous Complex, dynamic Networks Exchanges ATMs / Vouchers Payment Services Darknet Markets Mixing Services graphsense.info 30M clusters 480K blocks 1.5B relations 296M addresses 249M transactions For Whom? Science Public Authorities FinTech / Banks
  7. 7. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 7
  8. 8. EXAMPLE TRANSACTION 8
  9. 9. TRANSACTION PROCESSING Broadcast Transaction Blockchain 9 Bitcoin P2P Network
  10. 10. TRANSACTION PROCESSING Collect pending Transactions Blockchain 10 Bitcoin Miners Bitcoin P2P Network
  11. 11. TRANSACTION PROCESSING Find & Broadcast Block Bitcoin P2P Network Bitcoin Miners Blockchain 11
  12. 12. TRANSACTION PROCESSING Synchronize Blocks Blockchain 12 Bitcoin P2P Network
  13. 13. ANATOMY OF A BITCOIN TRANSACTION 13 txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature value: 0.00460479 n: 0 addresses: [1Archive…] value: 0.00566296 n: 1 addresses: [1MuSWq…] List of inputs List of outputs Bitcoin Addresses Reference to unspent output of previous transaction (UTXO)
  14. 14. ANATOMY OF A BITCOIN TRANSACTION 14 txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature value: 0.00460479 n: 0 addresses: [1Archive…] value: 0.00566296 n: 1 addresses: [1MuSWq…] sum(List of inputs) sum(List of outputs)≥
  15. 15. ANATOMY OF A BITCOIN TRANSACTION 15 txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature value: 0.00460479 n: 0 addresses: [1Archive…] value: 0.00566296 n: 1 addresses: [1MuSWq…] sum(List of inputs) sum(List of outputs)−Transaction Fee =
  16. 16. COINBASE TRANSACTION 16 txid: a60f6e2b... blockhash: 0000ba7.. coinbase: “0367c4...” value: 25.42394247 n: 0 addresses: [1KFHE7…]
  17. 17. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 17
  18. 18. My focus for today 18 TAXONOMY OF ANALYTICS METHODS Cryptocurrency Analytics P2P Network Analytics Blockchain Analytics Network Analytics Clustering Heuristics [Biryukov et al., 2014]
  19. 19. 19 BLOCKCHAIN ANALYTICS Blockchain Analytics Network Analytics Clustering Heuristics Transaction Network Address Network
  20. 20. 20 TRANSACTION NETWORK t1 t3 t2 t4 [Reid and Harrigan 2012] 0,00321 BTC 2016-03-14 17:33:50 directed acyclic temporal
  21. 21. 21 TRANSACTION NETWORK | CONSTRUCTION txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature vin value: 0.00460479 n: 0 addresses: [1Archive…] vout Target node id Source node id Timestamp (via referenced block) Value
  22. 22. 22 ADDRESS NETWORK a1 a2 a3 a5 a7 a8 a6 a9 a10 Estimated Value No. Transactions [Fleder et al. 2015, Filtz et al. 2017] (bi-)directed cyclic
  23. 23. 23 ADDRESS NETWORK | CONSTRUCTION txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature vin value: 0.00460479 n: 0 addresses: [1Archive…] vout Source node id Target node id No Transactions = aggregated count of edges with same node ids
  24. 24. 24 ESTIMATED VALUE | COMPUTATION inputs and outputs as shown in Table I. Fig. 2. Bitcoin transaction value assignment Therefore, we estimate the flow of actual Bitcoins betw two addresses using the following formula: TABLE I. BITCOINFLOW Transaction Formula Estimated BTC A1 A3 3 * (2/7) 0.857 A2 A3 3 * (5/7) 2.143 A1 A3 4 * (2/7) 1.143 A2 A4 4 * (5/7) 2.857 IV. ANALYSIS a1 → a3 = 3 ∗ & ' a1 tx a2 a3 a4 2 3 45 [Filtz et al. 2017]
  25. 25. 25 BLOCKCHAIN ANALYTICS Blockchain Analytics Network Analysis Clustering Heuristics Multiple-Input Heuristics [Nakamoto, 2008] Change Heuristics [Meiklejohn, 2013] Temporal Behaviour [Ortega, 2013] Transaction Fingerprinting [Fleder et. al, 2015]
  26. 26. c1 c1 MULTIPLE INPUT HEURISTICS 26 a1 tx a2 c2 a2 ty a3 Same address [Nakamoto, 2008]
  27. 27. c1 MULTIPLE INPUT HEURISTICS 27 a1 tx a2 a2 ty a3 Tag Tag [Nakamoto, 2008]
  28. 28. 28 BLOCKCHAIN ANALYTICS Blockchain Analytics Network Analysis Clustering Heuristics
  29. 29. c6c5 c4 c7 c3 c2 c1 29 CLUSTER / ENTITY NETWORK a1 a2 a3 a5 a7 a8 a6 a9 a10 Estimated Value No. Transactions directed cyclic
  30. 30. • Address clustering • is a cornerstone of cryptocurrency analysis • partitions the set of addresses observed in the Bitcoin blockchain into maximal subsets of addresses that are likely controlled by the same real-world actor • Multiple input heuristics can identify more than 69% of the addresses stored by lightweight clients MULTIPLE INPUT HEURISTICS | EFFECTIVENESS 30 [Harrigan and Fretter, 2016] Figure 1. A graphical summary of the most significant flows of bitcoin between the largest address clusters during Bitcoin’s first five years in existence. The vertices correspond to address clusters: red vertices are darknet markets; purple vertices are gambling services; green vertices are exchanges and blue vertices are mining pools. The gray vertices are not immediately identifiable using publicly available information. Maxwell described CoinJoin [12], a protocol for trust-
  31. 31. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 31
  32. 32. • Basic Functionality: 1Archive1n2C579dMsAu3iC6tWzuQJz8dN • Micro-level analysis: 3Nxwenay9Z8Lc9JBiywExpnEFiLp6Afp8v (Bitcoin Rich List) • Macro-level analysis: 1BjTR3NhTiVPKfbsZhrfx4vYKH4DLeh9UT (AlphaBay Market) DEMOS 32
  33. 33. GRAPH CONSTRUCTION APPROACH 33 A A A AA C T BlockchainAddress Graph Address Cluster Tags Enrichmentprocess [Haslhofer et al., 2016] Statistics (as of Sept. 2017) Transactions: 249,408,683 Addresses: 296,862,290 Clusters: 30,645,426 Address graph - nodes (= addresses): 296,862,290 - edges (= aggregated transactions): 1,567,227,841 All data points are pre-computed and stored in a de-normalized form
  34. 34. SOFTWARE COMPONENTS 34
  35. 35. OPEN SOURCE ! 35
  36. 36. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 36
  37. 37. • Ransomware has become dominant cybercrime threat • Over 500 families • Ransom payments almost exclusively in Bitcoin • More comprehensive, evidence-based picture still missing RANSOMWARE STUDY | MOTIVATION 37
  38. 38. 38 Preliminary results are omitted in public slide deck. Final results and paper is expected to published in Q2/2018
  39. 39. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 39
  40. 40. • Bitcoin linkability • All transactions can be linked to prior outputs • Allows construction of transaction, address, and cluster graphs • Monero obscures transactions by including chaff transaction inputs • Zcash supports shielded transactions to obscure parties and amounts • Ethereum is a “turing-complete” blockchain (smart contracts) POST-BITCOIN CURRENCY ANALYTICS 40
  41. 41. • Working hypothesis: • Bitcoin is supposed to be a decentralized system • However, it has very strong centralization tendencies • Best example: Mining business • Research Goals • Better understanding of mining business across ledgers • Investigate economic behavior to infer “real” structure of mining business INSIGHT INTO THE MINING ECONOMY 41
  42. 42. • Cybercriminals increasingly turn their attention to cryptocurrency services • Major target: cryptocurrency exchanges • Attacks are conducted in the same way as targeted attacks on banks with similar or sometimes identical tools and tactics • Comeback of fraudulent schemes (Ponzi scheme, investment scams, greater fool theory, etc.) • Idea: systematic investigation and monitoring for informed policy making FINANCIAL CRIME FORENSICS 42
  43. 43. • If actors in the cryptocurrency ecosystem exceed certain monetary thresholds, they might pose an economic risk • Ideas • Develop network-based methods to quantify risks • Stress test entire ecosystem • .... IDEA: SYSTEMIC RISK INVESTIGATION 43
  44. 44. O BITCOIN WHERE ART THOU? An Introduction to Cryptocurrency Analytics Dr. Bernhard Haslhofer bernhard.haslhofer@ait.ac.at
  45. 45. EVERYWHERE ! Cryptocurrency analytics contributes to a better understanding Dr. Bernhard Haslhofer bernhard.haslhofer@ait.ac.at
  46. 46. • [Nakamoto, 2008]: Bitcoin: A peer-to-peer electronic cash system • [Reid and Harrigan 2012]: An Analysis of Anonymity in the Bitcoin System • [Meiklejohn, 2013]: A fistful of bitcoins: characterizing payments among men with no names • [Ortega, 2013]: The bitcoin transaction graph—anonymity • [Biryukov et al., 2014]: Deanonymisation of clients in Bitcoin P2P network • [Fleder et. al, 2015]: Bitcoin Transaction Graph Analysis • [Haslhofer et. al, 2016]: O Bitcoin Where Art Thou? Insight into Large-Scale Transaction Graphs. • [Möser and Böhme, 2016]: Join Me on a Market for Anonymity • [Harrigan and Fretter, 2016]: The Unreasonable Effectiveness of Address Clustering • [Filtz et al, 2017]: Evolution of the Bitcoin Address Graph • [Miller et al, 2017]: An Empirical Analysis of Linkability in the Monero Blockchain • [Kumer et al, 2017]: A Traceability Analysis of Monero's Blockchain • [Quesnelle 2017]: On the Linkability of ZCash transactions REFERENCES 46

×