A Collective Anomaly Detection Method Over Bitcoin Network

TL;DR

This paper introduces a collective anomaly detection method for Bitcoin that improves fraud detection by focusing on user behavior rather than individual addresses, using clustering techniques to identify fraudulent users more effectively.

Contribution

The study presents a novel collective anomaly detection approach combined with Trimmed_Kmeans clustering to identify fraudulent users in Bitcoin, outperforming previous address-based methods.

Findings

Successfully identified 14 fraudulent users with 26 addresses in 9 cases.

Outperformed previous methods by detecting more addresses and cases of fraud.

Reduced processing power needed for feature extraction.

Abstract

The popularity and amazing attractiveness of cryptocurrencies, and especially Bitcoin, absorb countless enthusiasts daily. Although Blockchain technology prevents fraudulent behavior, it cannot detect fraud on its own. There are always unimaginable ways to commit fraud, and the need to use anomaly detection methods to identify abnormal and fraudulent behaviors has become a necessity. The main purpose of this study is to present a new method for detecting anomalies in Bitcoin with more appropriate efficiency. For this purpose, in this study, the diagnosis of the collective anomaly was used, and instead of diagnosing the anomaly of individual addresses and wallets, the anomaly of users was examined, and the anomaly was more visible among users who had multiple wallets. In addition to using the collective anomaly detection method in this study, the Trimmed_Kmeans algorithm was used for clustering and the proposed method succeeded in identifying 14 users who had committed theft, fraud, and hack with 26 addresses in 9 cases. Compared to previous works, which detected a maximum of 7 addresses in 5 cases of fraud, the proposed method has performed well. Therefore, the proposed method, by presenting a new approach, in addition to reducing the processing power to extract features, succeeded in detecting abnormal users and also was able to find more transactions and addresses committed a scam.