Anomaly Detection in Bitcoin Network Using Unsupervised Learning Methods

TL;DR

This paper explores unsupervised machine learning techniques to detect suspicious users and transactions in the Bitcoin network, aiming to identify anomalies that may indicate illegal activities.

Contribution

It applies and compares three unsupervised learning methods on Bitcoin transaction graphs to identify anomalies, a novel approach for this specific financial network.

Findings

Unsupervised methods can identify suspicious Bitcoin activities.

k-means, Mahalanobis distance, and SVM show promising results.

Graph-based anomaly detection is effective in financial networks.

Abstract

The problem of anomaly detection has been studied for a long time. In short, anomalies are abnormal or unlikely things. In financial networks, thieves and illegal activities are often anomalous in nature. Members of a network want to detect anomalies as soon as possible to prevent them from harming the network's community and integrity. Many Machine Learning techniques have been proposed to deal with this problem; some results appear to be quite promising but there is no obvious superior method. In this paper, we consider anomaly detection particular to the Bitcoin transaction network. Our goal is to detect which users and transactions are the most suspicious; in this case, anomalous behavior is a proxy for suspicious behavior. To this end, we use three unsupervised learning methods including k-means clustering, Mahalanobis distance, and Unsupervised Support Vector Machine (SVM) on two graphs generated by the Bitcoin transaction network: one graph has users as nodes, and the other has transactions as nodes.