Toward Intention Discovery for Early Malice Detection in Bitcoin

TL;DR

This paper introduces an interpretable, real-time intention discovery model for early detection of illicit activities in Bitcoin, combining asset transfer paths, feature segmentation, clustering, and a hierarchical self-attention predictor.

Contribution

It presents a novel, interpretable framework that detects Bitcoin illicit activities early and in real-time, addressing limitations of prior deep learning approaches.

Findings

Outperforms state-of-the-art methods on real-world datasets

Provides interpretable explanations for illicit activity detection

Capable of discovering new suspicious patterns

Abstract

Bitcoin has been subject to illicit activities more often than probably any other financial assets, due to the pseudo-anonymous nature of its transacting entities. An ideal detection model is expected to achieve all the three properties of (I) early detection, (II) good interpretability, and (III) versatility for various illicit activities. However, existing solutions cannot meet all these requirements, as most of them heavily rely on deep learning without satisfying interpretability and are only available for retrospective analysis of a specific illicit type. First, we present asset transfer paths, which aim to describe addresses' early characteristics. Next, with a decision tree based strategy for feature selection and segmentation, we split the entire observation period into different segments and encode each as a segment vector. After clustering all these segment vectors, we get the global status vectors, essentially the basic unit to describe the whole intention. Finally, a hierarchical self-attention predictor predicts the label for the given address in real time. A survival module tells the predictor when to stop and proposes the status sequence, namely intention. % With the type-dependent selection strategy and global status vectors, our model can be applied to detect various illicit activities with strong interpretability. The well-designed predictor and particular loss functions strengthen the model's prediction speed and interpretability one step further. Extensive experiments on three real-world datasets show that our proposed algorithm outperforms state-of-the-art methods. Besides, additional case studies justify our model can not only explain existing illicit patterns but can also find new suspicious characters.