Identifying Ransomware Actors in the Bitcoin Network

TL;DR

This paper develops new graph-based algorithms to identify ransomware actors in Bitcoin networks, achieving 85% accuracy by analyzing local transaction patterns and distinguishing them from gambling and random actors.

Contribution

It introduces novel local clustering and supervised graph machine learning algorithms specifically designed for detecting malicious Bitcoin actors.

Findings

Achieved 85% prediction accuracy in identifying ransomware actors.

Local transaction subgraphs are sufficient for effective classification.

Algorithms differentiate ransomware from gambling and random actors.

Abstract

Due to the pseudo-anonymity of the Bitcoin network, users can hide behind their bitcoin addresses that can be generated in unlimited quantity, on the fly, without any formal links between them. Thus, it is being used for payment transfer by the actors involved in ransomware and other illegal activities. The other activity we consider is related to gambling since gambling is often used for transferring illegal funds. The question addressed here is that given temporally limited graphs of Bitcoin transactions, to what extent can one identify common patterns associated with these fraudulent activities and apply them to find other ransomware actors. The problem is rather complex, given that thousands of addresses can belong to the same actor without any obvious links between them and any common pattern of behavior. The main contribution of this paper is to introduce and apply new algorithms for local clustering and supervised graph machine learning for identifying malicious actors. We show that very local subgraphs of the known such actors are sufficient to differentiate between ransomware, random and gambling actors with 85% prediction accuracy on the test data set.