ICACT20210137 Slide.20
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Thank you for your listening
|
|
ICACT20210137 Slide.19
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The wallets filtered by the temporary rule are located at the edge of the network. This type of wallet helps to improve the centrality of the overall transaction.
The visual analysis of the transaction network can provide both the macro and micro view of the complex bitcoin transaction network.
Future research directions may include developing more diversified judgment standards of change wallets and collect more transaction records to conclude solid research conclusions.
|
|
ICACT20210137 Slide.18
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The previous method of investigating money flow cannot be applied to the trade with virtual currency, mainly because virtual currency generates many change wallets. From the number of filtered wallets, using the two rules in this study can detect 6% of the address as change wallets.
Comparing the filtered wallets by two rules, more wallets are filtered by temporary rule. From the perspective of the network structure, the wallets detected by the input-output differential rule belong to the clusters and with higher degrees of centrality.
|
|
ICACT20210137 Slide.17
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We have summarized the number of the change wallets filtered by different rules in the 3 wallets, as shown in the left table. The reason why there are more wallets filtered by rule 2 is probably due to the generation mechanism of change wallets. Because the change address is generated by the original wallet during the transaction, a new change address will be automatically created. Unless the original input wallet itself is used as a change wallet or the input money is exactly equal to the output money, a new change wallet will usually be generated during the transaction. As for the stricter conditions to be met by rule1, it is not easy to meet the filter conditions from a large number of input and output wallet transactions, so the number of wallets filtered by rule 1 is less by rule 2.
We demonstrate the difference between the three wallets in social network analysis statistics, as shown in the right table. From the point of view of the size indicator, the percentage of change wallets removed by wallet 1 and wallet 3 is more, while wallet 2 removed less change wallets. From the edge index, because the wallets filtered by rule1 belong to the cluster structure, the number of edges reduced is more than that of wallet 2 and 3. For density, the value is proportional to the reducing number of change wallets. For diameter, removing more change wallets by rule 1, most are cluster structure, might greatly reduce the value of the diameter. As for the centrality indicators of SNA, because the wallets removed by rule1 are the nodes with higher degree centrality, only the degree centrality value of wallet 1 decreases. Betweenness centrality and closeness centrality are highly related to the number of removed change wallets. Eigenvector centrality is related to neither the number nor types of the change wallets.
|
|
ICACT20210137 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The figure shows that the change wallets filtered out by the rule2 are located in the marginal area of the target wallet group. And most of them are in the form of a pair. The rectangles in this figure are the change wallets detected by rule 2, and their location demonstrate the paired structures, such as 3KHcRN vs 3JzJ5V and 3KHcRN vs 3JzJ5V. Because the change wallet pairs are less connected to other wallets, the structural difference caused by rule 2 is not as obvious as by rule 1. Therefore, rule 2 produces less impact on the overall transaction structure.
|
|
ICACT20210137 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The figure shows that the change wallet 32AhjH is surrounded by several wallets, e.g. 3E26if, 39wuko, 32kiod, 3JBPL7, 32ghxz and 3GXCJW etc., and creates a cluster. Since the change wallet 32AhjH is the center of the cluster, it should play an important role in flow analysis due to its high centrality. On the contrary, change wallets are not important in flow analysis. This incorrect information may lead the misjudgment on explaining the importance of the wallets. When the change wallet 32AhjH is removed, the cluster members show their connection with the target wallet 3QR1Dp .
|
|
ICACT20210137 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The first wallet has 31 transactions with 284 addresses. The addresses which fit the criteria of the change wallet rule are shown in Table on the right. There are four change wallets detected by rule 1 while 15 wallets are detected by rule 2. The network on the left shows the transaction flow of wallet 1, and the network on the right shows the flow of wallet 1 without change wallets.
|
|
ICACT20210137 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We use three bitcoin wallets provided by Criminal Investigation Bureau, Taiwan, as the testbed. The three wallets are highly suspected of committing criminal activities. The three wallets are shown as follows. We take first wallet , start with 3QR1Dp, as an example.
|
|
ICACT20210137 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The macro view focuses on discussing the overall structure. We describe the macro-level information of the network with its averaged SNA statistics to represent the distinctive characteristics of the whole network. On the other hand, the micro view describes the local connections or locations for the specific node. The goal of this phase is to help investigators track the illicit financial flow in an effective and direct way.
|
|
ICACT20210137 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Rule1: Input-output differential rule
In bitcoin wallet transactions, the sum of the input's wallets must be equal to the total amount of the output, except for the miner fee. To distinguish a wallet generated for storing the balance but not a wallet-to-wallet transaction, we remove the wallet with the smallest amount on the input side. If the rest of the total amount of wallet on the input side is still less than the largest wallet on the output side, it means that all the wallets on the input side have to pay to the largest wallet on the output side. In other words, there are no extra wallets on the input side to conduct a wallet-to-wallet transaction with the wallets on the output side. Therefore, if there exists a wallet on the output side rather than the largest wallet, it should be the change wallet. We use this rule to exclude any possibilities that the change wallets receive bitcoin from the input wallets.
Rule 2: Temporary rule
The primary function of the change wallet is to store the difference between input and output. Therefore, there is usually no previous transaction records before the change wallet is generated. Thus, there should usually be two transactions for the change wallets, the first one is the transaction to generate the change wallets, and the second one is the transaction to empty the change wallet for importing the remaining value to the main wallet. Therefore, we implement rule 2 to detect the wallets, which only have two transactions as the change wallets.
|
|
ICACT20210137 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This research uses python to implement a website crawler and uses the API (Application Programming Interface) provided by blockchain.com for data collection. The API can responses the structural transaction history with a hash query, which may represent either a wallet address or a transaction ID. The figure on the right shows the transaction history of the wallet 3QR1DpJMNAap42wgSyNvAtPGqrxGhQnEkN. The address on the left are inputs while those on the right are outputs. We further parse the retrieved JSON format data and standardize the features for change wallet detection.
|
|
ICACT20210137 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
There are three phases in this research. First, the bitcoin transaction data was collected from the bitcoin trading platform with crawlers. Second, we implement two change wallet detection rules by observing the criteria of bitcoin UTXO characteristics. Finally, we conduct the visualized analysis of the change wallets to find its structural implication regarding social network features
|
|
ICACT20210137 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We use six indicators to describe the characteristics of a network, which are Size, Density, Diameter, Degree, Closeness, Betweenness. These six indicators are used to discover what’s the difference after deploying change wallet mechanism in current bitcoin transaction networks.
|
|
ICACT20210137 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Social Network Analysis (SNA) is a method for analyzing the relationship structure and attributes of social networks.
Social network analysis can analyze social networks from many different perspectives, including centrality analysis, cohesive subgroup analysis, core-periphery structure analysis, and structural equivalence analysis.
|
|
ICACT20210137 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In a criminal investigation, the analysis of the financial flow of the suspect is very critical. Nonetheless, the lack of knowledge on bitcoin change wallets will mislead the direction of the investigation. Therefore, determining the change wallet of bitcoin can effectively reduce the noise of financial flow analysis for law enforcement agencies.
|
|
ICACT20210137 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Bitcoin is a cryptocurrency invented in 2008 by “Satoshi Nakamoto”.
Bitcoin is a virtual currency built on blockchain technology. and is not issued through any countries or financial institutions, but through the algorithms to calculate issuance and conduct transactions.
The decentralized nature of P2P and the algorithm itself can ensure that the currency's value cannot be manipulated through the large-scale production of bitcoin.
The payer (or input) needs to digitally sign the transaction with its private key to prove ownership and approve it. The value of the transaction will be recorded on the address of the recipient (or output).
|
|
ICACT20210137 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
However, many law enforcement agencies are not aware of this crisis because of its complicated technology and innovative operating processes. It is difficult to track the bitcoin flow due to its UTXO (Unspent Transaction Output) transaction characteristics, which is different from traditional strategy for financial flow investigation. Therefore, we implement a rule-based detection framework to discover change wallets from bitcoin transactions and visualize its structural characteristics.
|
|
ICACT20210137 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Many illegal websites on the dark web trade firearms, drugs, and child pornography in bitcoin. Bitcoin transactions are difficult to trace the true identity of the payer. Bitcoin has the characteristics of high anonymity, decentralization, peer-to-peer, and the use of asymmetric encryption, and has become a new criminal tool often used in organized crimes. Also, the transaction process is prone to forming breakpoints in the cash flow, which increases the difficulty for law enforcement investigators to track down the suspicious bank accounts.
|
|
ICACT20210137 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This is the outline of my presentation. First, I will give a brief introduction of our research. In literature review, I will review the related researches and point the research gaps. In research framework, I will introduce a model which composed of three phases to collect data, analyze transaction records and provide the visualized results. In experimental analysis part, we will give a systematic comparison between transaction networks with and without change wallets detection mechanism. Finally, we conclude the paper and makes some suggestions for future work.
|
|
ICACT20210137 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Hi, everyone. My name is Fuching Tsai. I am currently an assistance professor of criminal investigation department of Central Police University, Taiwan. I am very glad to present my research the visualized analysis of bitcoin change wallets in the coin flow network.
|
