From Asset Flow to Status, Action and Intention Discovery: Early Malice Detection in Cryptocurrency

TL;DR

This paper introduces an interpretable, versatile early detection model for illicit activities in Bitcoin, leveraging on-chain data and novel modules to outperform existing methods and uncover new suspicious patterns.

Contribution

The paper presents a new early malice detection framework combining decision-tree feature selection and intent embedding, addressing interpretability and versatility limitations of prior deep learning approaches.

Findings

Outperforms state-of-the-art methods on real datasets

Provides interpretable explanations for illicit activities

Detects new suspicious patterns beyond known illicit types

Abstract

Cryptocurrency has been subject to illicit activities probably more often than traditional financial assets due to the pseudo-anonymous nature of its transacting entities. An ideal detection model is expected to achieve all three critical properties of (I) early detection, (II) good interpretability, and (III) versatility for various illicit activities. However, existing solutions cannot meet all these requirements, as most of them heavily rely on deep learning without interpretability and are only available for retrospective analysis of a specific illicit type. To tackle all these challenges, we propose Intention-Monitor for early malice detection in Bitcoin (BTC), where the on-chain record data for a certain address are much scarcer than other cryptocurrency platforms. We first define asset transfer paths with the Decision-Tree based feature Selection and Complement (DT-SC) to build different feature sets for different malice types. Then, the Status/Action Proposal Module (S/A-PM) and the Intention-VAE module generate the status, action, intent-snippet, and hidden intent-snippet embedding. With all these modules, our model is highly interpretable and can detect various illegal activities. Moreover, well-designed loss functions further enhance the prediction speed and model's interpretability. Extensive experiments on three real-world datasets demonstrate that our proposed algorithm outperforms the state-of-the-art methods. Furthermore, additional case studies justify our model can not only explain existing illicit patterns but can also find new suspicious characters.