Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

O Bitcoin Where Art Thou? An Introduction to Cryptocurrency Analytics

141 views

Published on

An overview of current cryptocurrency analytics methods and tools.

Published in: Data & Analytics
  • Be the first to comment

O Bitcoin Where Art Thou? An Introduction to Cryptocurrency Analytics

  1. 1. O BITCOIN WHERE ART THOU? An Introduction to Cryptocurrency Analytics Dr. Bernhard Haslhofer Oesterreichische Nationalbank (OeNB) | Research Seminar 2018-01-12
  2. 2. 1. Which cryptocurrency should I buy? 2. What do you think about cryptocurrency X? 3. Where can I buy cryptocurrency X? Is it safe? 4. Can you help me setting up a cold wallet? 5. How will the price of cryptocurrency X evolve? MOST FREQUENT QUESTIONS I GET 2
  3. 3. PUBLIC ATTENTION 3
  4. 4. • Cryptocurrencies have entered mainstream • Public opinion is often misinformed and based on insufficient and / or unexamined evidence • Systematic scientific examination of entire cryptocurrency ecosystems still in its infancy • Missing methods, insufficient tool support MOTIVATION Image source: https://www.flickr.com/photos/namecoin/22995486509 4
  5. 5. • Contribute to a better understanding of the structure and dynamics of cryptocurrency ecosystems • Multidisciplinary cooperation to answer specific (research) questions related to cryptocurrencies • Develop scalable quantitative methods, tools and services that help in answering those questions • Micro-level analysis: inspect atomic entities (block, transaction, address, currency flow) • Macro-level analysis: investigate real-world actors and services and their relationships OUR GOALS CRYPTOCURRENCY ANALYTICS 5
  6. 6. INSIGHT INTO CRYPTOCURRENCY ECOSYSTEMS Global De-centralized Transparent Pseudo-Anonymous Complex, dynamic Networks Exchanges ATMs / Vouchers Payment Services Darknet Markets Mixing Services graphsense.info 30M clusters 480K blocks 1.5B relations 296M addresses 249M transactions For Whom? Science Public Authorities FinTech / Banks
  7. 7. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 7
  8. 8. EXAMPLE TRANSACTION 8
  9. 9. TRANSACTION PROCESSING Broadcast Transaction Blockchain 9 Bitcoin P2P Network
  10. 10. TRANSACTION PROCESSING Collect pending Transactions Blockchain 10 Bitcoin Miners Bitcoin P2P Network
  11. 11. TRANSACTION PROCESSING Find & Broadcast Block Bitcoin P2P Network Bitcoin Miners Blockchain 11
  12. 12. TRANSACTION PROCESSING Synchronize Blocks Blockchain 12 Bitcoin P2P Network
  13. 13. ANATOMY OF A BITCOIN TRANSACTION 13 txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature value: 0.00460479 n: 0 addresses: [1Archive…] value: 0.00566296 n: 1 addresses: [1MuSWq…] List of inputs List of outputs Bitcoin Addresses Reference to unspent output of previous transaction (UTXO)
  14. 14. ANATOMY OF A BITCOIN TRANSACTION 14 txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature value: 0.00460479 n: 0 addresses: [1Archive…] value: 0.00566296 n: 1 addresses: [1MuSWq…] sum(List of inputs) sum(List of outputs)≥
  15. 15. ANATOMY OF A BITCOIN TRANSACTION 15 txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature value: 0.00460479 n: 0 addresses: [1Archive…] value: 0.00566296 n: 1 addresses: [1MuSWq…] sum(List of inputs) sum(List of outputs)−Transaction Fee =
  16. 16. COINBASE TRANSACTION 16 txid: a60f6e2b... blockhash: 0000ba7.. coinbase: “0367c4...” value: 25.42394247 n: 0 addresses: [1KFHE7…]
  17. 17. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 17
  18. 18. My focus for today 18 TAXONOMY OF ANALYTICS METHODS Cryptocurrency Analytics P2P Network Analytics Blockchain Analytics Network Analytics Clustering Heuristics [Biryukov et al., 2014]
  19. 19. 19 BLOCKCHAIN ANALYTICS Blockchain Analytics Network Analytics Clustering Heuristics Transaction Network Address Network
  20. 20. 20 TRANSACTION NETWORK t1 t3 t2 t4 [Reid and Harrigan 2012] 0,00321 BTC 2016-03-14 17:33:50 directed acyclic temporal
  21. 21. 21 TRANSACTION NETWORK | CONSTRUCTION txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature vin value: 0.00460479 n: 0 addresses: [1Archive…] vout Target node id Source node id Timestamp (via referenced block) Value
  22. 22. 22 ADDRESS NETWORK a1 a2 a3 a5 a7 a8 a6 a9 a10 Estimated Value No. Transactions [Fleder et al. 2015, Filtz et al. 2017] (bi-)directed cyclic
  23. 23. 23 ADDRESS NETWORK | CONSTRUCTION txid: a6b06e... blockhash: 0000ba7.. txid: 7f252a …. vout: 1 scriptSig: Signature vin value: 0.00460479 n: 0 addresses: [1Archive…] vout Source node id Target node id No Transactions = aggregated count of edges with same node ids
  24. 24. 24 ESTIMATED VALUE | COMPUTATION inputs and outputs as shown in Table I. Fig. 2. Bitcoin transaction value assignment Therefore, we estimate the flow of actual Bitcoins betw two addresses using the following formula: TABLE I. BITCOINFLOW Transaction Formula Estimated BTC A1 A3 3 * (2/7) 0.857 A2 A3 3 * (5/7) 2.143 A1 A3 4 * (2/7) 1.143 A2 A4 4 * (5/7) 2.857 IV. ANALYSIS a1 → a3 = 3 ∗ & ' a1 tx a2 a3 a4 2 3 45 [Filtz et al. 2017]
  25. 25. 25 BLOCKCHAIN ANALYTICS Blockchain Analytics Network Analysis Clustering Heuristics Multiple-Input Heuristics [Nakamoto, 2008] Change Heuristics [Meiklejohn, 2013] Temporal Behaviour [Ortega, 2013] Transaction Fingerprinting [Fleder et. al, 2015]
  26. 26. c1 c1 MULTIPLE INPUT HEURISTICS 26 a1 tx a2 c2 a2 ty a3 Same address [Nakamoto, 2008]
  27. 27. c1 MULTIPLE INPUT HEURISTICS 27 a1 tx a2 a2 ty a3 Tag Tag [Nakamoto, 2008]
  28. 28. 28 BLOCKCHAIN ANALYTICS Blockchain Analytics Network Analysis Clustering Heuristics
  29. 29. c6c5 c4 c7 c3 c2 c1 29 CLUSTER / ENTITY NETWORK a1 a2 a3 a5 a7 a8 a6 a9 a10 Estimated Value No. Transactions directed cyclic
  30. 30. • Address clustering • is a cornerstone of cryptocurrency analysis • partitions the set of addresses observed in the Bitcoin blockchain into maximal subsets of addresses that are likely controlled by the same real-world actor • Multiple input heuristics can identify more than 69% of the addresses stored by lightweight clients MULTIPLE INPUT HEURISTICS | EFFECTIVENESS 30 [Harrigan and Fretter, 2016] Figure 1. A graphical summary of the most significant flows of bitcoin between the largest address clusters during Bitcoin’s first five years in existence. The vertices correspond to address clusters: red vertices are darknet markets; purple vertices are gambling services; green vertices are exchanges and blue vertices are mining pools. The gray vertices are not immediately identifiable using publicly available information. Maxwell described CoinJoin [12], a protocol for trust-
  31. 31. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 31
  32. 32. • Basic Functionality: 1Archive1n2C579dMsAu3iC6tWzuQJz8dN • Micro-level analysis: 3Nxwenay9Z8Lc9JBiywExpnEFiLp6Afp8v (Bitcoin Rich List) • Macro-level analysis: 1BjTR3NhTiVPKfbsZhrfx4vYKH4DLeh9UT (AlphaBay Market) DEMOS 32
  33. 33. GRAPH CONSTRUCTION APPROACH 33 A A A AA C T BlockchainAddress Graph Address Cluster Tags Enrichmentprocess [Haslhofer et al., 2016] Statistics (as of Sept. 2017) Transactions: 249,408,683 Addresses: 296,862,290 Clusters: 30,645,426 Address graph - nodes (= addresses): 296,862,290 - edges (= aggregated transactions): 1,567,227,841 All data points are pre-computed and stored in a de-normalized form
  34. 34. SOFTWARE COMPONENTS 34
  35. 35. OPEN SOURCE ! 35
  36. 36. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 36
  37. 37. • Ransomware has become dominant cybercrime threat • Over 500 families • Ransom payments almost exclusively in Bitcoin • More comprehensive, evidence-based picture still missing RANSOMWARE STUDY | MOTIVATION 37
  38. 38. 38 Preliminary results are omitted in public slide deck. Final results and paper is expected to published in Q2/2018
  39. 39. • Bitcoin: A (Very) Brief Introduction • Cryptocurrency Analytics Methods • GraphSense Cryptocurrency Analytics Platform • Example Study: Ransomware Payments in the Bitcoin Ecosystem • Future Research Directions • Q & A MY PLAN FOR TODAY 39
  40. 40. • Bitcoin linkability • All transactions can be linked to prior outputs • Allows construction of transaction, address, and cluster graphs • Monero obscures transactions by including chaff transaction inputs • Zcash supports shielded transactions to obscure parties and amounts • Ethereum is a “turing-complete” blockchain (smart contracts) POST-BITCOIN CURRENCY ANALYTICS 40
  41. 41. • Working hypothesis: • Bitcoin is supposed to be a decentralized system • However, it has very strong centralization tendencies • Best example: Mining business • Research Goals • Better understanding of mining business across ledgers • Investigate economic behavior to infer “real” structure of mining business INSIGHT INTO THE MINING ECONOMY 41
  42. 42. • Cybercriminals increasingly turn their attention to cryptocurrency services • Major target: cryptocurrency exchanges • Attacks are conducted in the same way as targeted attacks on banks with similar or sometimes identical tools and tactics • Comeback of fraudulent schemes (Ponzi scheme, investment scams, greater fool theory, etc.) • Idea: systematic investigation and monitoring for informed policy making FINANCIAL CRIME FORENSICS 42
  43. 43. • If actors in the cryptocurrency ecosystem exceed certain monetary thresholds, they might pose an economic risk • Ideas • Develop network-based methods to quantify risks • Stress test entire ecosystem • .... IDEA: SYSTEMIC RISK INVESTIGATION 43
  44. 44. O BITCOIN WHERE ART THOU? An Introduction to Cryptocurrency Analytics Dr. Bernhard Haslhofer bernhard.haslhofer@ait.ac.at
  45. 45. EVERYWHERE ! Cryptocurrency analytics contributes to a better understanding Dr. Bernhard Haslhofer bernhard.haslhofer@ait.ac.at
  46. 46. • [Nakamoto, 2008]: Bitcoin: A peer-to-peer electronic cash system • [Reid and Harrigan 2012]: An Analysis of Anonymity in the Bitcoin System • [Meiklejohn, 2013]: A fistful of bitcoins: characterizing payments among men with no names • [Ortega, 2013]: The bitcoin transaction graph—anonymity • [Biryukov et al., 2014]: Deanonymisation of clients in Bitcoin P2P network • [Fleder et. al, 2015]: Bitcoin Transaction Graph Analysis • [Haslhofer et. al, 2016]: O Bitcoin Where Art Thou? Insight into Large-Scale Transaction Graphs. • [Möser and Böhme, 2016]: Join Me on a Market for Anonymity • [Harrigan and Fretter, 2016]: The Unreasonable Effectiveness of Address Clustering • [Filtz et al, 2017]: Evolution of the Bitcoin Address Graph • [Miller et al, 2017]: An Empirical Analysis of Linkability in the Monero Blockchain • [Kumer et al, 2017]: A Traceability Analysis of Monero's Blockchain • [Quesnelle 2017]: On the Linkability of ZCash transactions REFERENCES 46

×