A Suite of Tools for the Forensic Analysis of Bitcoin Transactions: - PowerPoint PPT Presentation

A Suite of Tools for the Forensic Analysis of Bitcoin Transactions: Preliminary Report Stefano Bistarelli, Ivan Mercanti and Francesco Santini UNIVERSITÀ DEGLI STUDI DI PERUGIA Dipartimento di Matematica e Informatica EURO-PAR 2018 WS FPDAPP 28-08-2018

BLOCKCHAINVIS SUITE

A SUITE OF TOOLS FOR THE FORENSIC ANALYSIS OF BITCOIN TRANSACTIONS AGENDA ▸ BlockchainVis Suite ▸ Modules ▸ Future works

BLOCKCHAINVIS SUITE SYSTEM DESIGN

Bitcoin Node BITCORE NODE

BITCOIN NETWORK BITCOIN User Traders Block N Exchange Block 2 Blockchain Block 1 Block 0 Miners

BITCOIN TRANSACTIONS HOW TRANSACTIONS WORK

BITCORE NODE BITCOIN CORE

Scraper BITCOIN ADRESSES SCRAPER

BITCOIN ADRESSES SCRAPER SET OF USED SCRAPERS ▸ User-names on Bitcoin Talk and Bitcoin-OTC; ▸ Physical coins created by Casascius; ▸ Known scammers on the Bitcoin-OTC and Bitcoin Talk trust system; ▸ Name tags on block-chain.info. 
 ▸

Blockchain DB DATABASE OF TRANSACTIONS

DATABASE OF TRANSACTIONS THE BLOCKCHAIN IN A DB

Mixing Services MIXING SERVICES DETECTOR

MIXING SERVICES DETECTOR MIXING SERVICES Mixing services

MIXING SERVICES DETECTOR MIXING SERVICES Mixing Service Fees Return Time Minimum import Maximum import Name Helix Light 3% 10 minutes - 24 0.01 BTC 43 BTC hours Bitcoin Blender 1-3% 0 - 99 hours 0.01 BTC None Coin Cloud 1% Instantaneous 0.01 BTC None (less then 1 hour) CoinMixer 1-3% + 0.0006 Hours 0.01 BTC None BTC BitClock Random around Hours 0.02 BTC 10 BTC 2% + 0.0008 BTC

MIXING SERVICES DETECTOR DATA SET Mixing services transactions 
 All transactions 
 Type Made with mixing services Obtained from the Block-chain Time range From 25 September 2017 From 25 September 2017 To 22 October 2017 To 22 October 2017 Label Label with the name of the No label service Number of transactions 973 7,852,074

MIXING SERVICES DETECTOR BEHAVIORAL PATTERNS

MIXING SERVICES DETECTOR COINMIXER #output address <=100 #output address > 100 V < 1000 #output address >=1000 Transactions Edge

MIXING SERVICES DETECTOR 14 SUSPICIOUS TRANSACTIONS #output address <=100 ▸ Number of input addresses equal to 2 #output address > 100 V < 1000 #output address >=1000 ▸ Number of output addresses in the range [2530, 2534] ▸ They were collected one a day, for 14 consecutive days. Transactions Edge

MIXING SERVICES DETECTOR SIMILARITY OF ADDRESS SETS Transaction TX 1 TX 2 TX 3 TX 4 TX 5 TX 6 TX 7 TX 1 100% 98% 97% 96% 95% 93% 93% Transaction TX 8 TX 9 TX10 TX 11 TX 12 TX 13 TX 14 TX 1 91.78 91% 90% 90% 89% 88% 88%

Mixing Services Visualizations BLOCKCHAINVIS (VISUALISATION)

BLOCKCHAINVIS VISUALIZATION LAYER

BLOCKCHAINVIS ISLAND VISUALIZATION

BLOCKCHAINVIS ISLAND VISUALIZATION

BLOCKCHAINVIS WANNA CRY

Clustering Mixing Services BITCOIN ADDRESSES CLUSTERISER

BITCOIN ADDRESSES CLUSTERISER MULTI-INPUT HEURISTIC Input 0 address Output 0 address Input 1 address Transaction Input 2 address Output 1 address

BITCOIN ADDRESSES CLUSTERISER MULTI-INPUT HEURISTIC Input 0 address Output 0 address Input 1 address Transaction Input 2 address Output 1 address

BITCOIN ADDRESSES CLUSTERISER SHADOW, CONSUMER AND OPTIMAL CHANGE HEURISTIC Output 0 address Input address Transaction Output 1 address

BITCOIN ADDRESSES CLUSTERISER SHADOW, CONSUMER AND OPTIMAL CHANGE HEURISTIC Output address Input address Transaction Output change address

BITCOIN ADDRESSES CLUSTERISER ONE-TO-ONE HEURISTIC Input 0 address Transaction Output 0 address

BITCOIN ADDRESSES CLUSTERISER ONE-TO-ONE HEURISTIC Input 0 address Transaction Output 0 address

BITCOIN ADDRESSES CLUSTERISER THE MULTISIG-ONE HEURISTIC Output 0 address 0 Input 0 address Transaction Output 0 address 1 Output 0 address 2

BITCOIN ADDRESSES CLUSTERISER THE MULTISIG-ONE HEURISTIC Output 0 address 0 Input 0 address Transaction Output 0 address 1 Output 0 address 2

BITCOIN ADDRESSES CLUSTERISER THE MULTISIG-TWO HEURISTIC Output 0 address 0 Output 0 address 1 Input 0 address Transaction Output 0 address 2 Output 0 address 3

BITCOIN ADDRESSES CLUSTERISER THE MULTISIG-TWO HEURISTIC Output 0 address 0 Output 0 address 0 Output 0 address 1 Input 0 address Transaction Output 0 address 1 Output 0 address 2 Output 0 address 3

BITCOIN ADDRESSES CLUSTERISER BITCOIN ADDRESSES CLUSTERED Heuristic Clustered % of clustered Addresses Addreses MI 83,867,895 72.61 OC 5,004,254 4.33 MS1 520,396 0.45 MS2 2,263 0.001 MI+OC 87,613,567 75.86 MI+MS1 84,372,511 73.05 MI+MS2 83,868,035 72.61 OC+MS1 5,523,007 4.78 OC+MS2 5,006,484 4.33 MS1+MS2 521,263 0.45 MI+OC+MS1 88,116,265 76.29 MI+OC+MS2 87,613,699 75.86 MI+OC+MS1 84,373,211 72.61 OC+MS1+MS2 5,523,859 4.78 MI+OC+MS1+MS2 88,116,388 76.29

Mixing Services Tx Info TRANSACTION INFORMATION

TRANSACTION INFORMATION STANDARD VS NON STANDARD 782.123.115 55.509.759 100000000 220.857 10000 304 1 STANDARD NON STANDARD

TRANSACTION INFORMATION DISTRIBUTION OF STANDARD TRANSACTIONS P2PKH P2PK Multi-signature OP_RETURN P2SH P2WPKH P2WSH 1000000000 1000000 1000 1

TRANSACTION INFORMATION DISTRIBUTION OF NON STANDARD TRANSACTIONS OnlyHash P2Pool Bug CLTV MIN EQUAL P2PKH NOP P2PKH 0 RETURN ERROR P2H Others 1.000 100 10 1

TRANSACTION INFORMATION DISTRIBUTION OF MINERS IN NON-STANDARD TRANSACTIONS BitClub 2% P2Pool 64% UNKNOWN 20% AntPool 1% F2Pool BTC Guild 4% 1% Eligius 5% Bitcoin-India 3%

CONCLUSIONI FUTURE WORKS ▸ Bitcore Node: build a graphical interface. ▸ Database of transactions: build Spark DB with Mesh to store the graph structure of transactions and a MongoDB for visualizations. ▸ Mixing Services Detector: fully automatised the module. ▸ Bitcoin Addresses Clusteriser: clustered addresses with all aforementioned heuristics. ▸ Transaction Information: study P2SH, the aim is to investigate such scripts.

CONCLUSIONI FUTURE WORKS ▸ We plan to build a new module that show informations about miners, called Miner analysis . ▸ Make BlockchainVis Suite able to analyse not only Bitcoin, but also other crypto-currencies, as Ethereum for example.

CONCLUSIONI RELATED PUBLICATIONS ▸ Stefano Bistarelli, Matteo Parroccini, Francesco Santini: Visualizing Bitcoin Flows of Ransomware: WannaCry One Week Later . ITASEC 2018 ▸ Stefano Bistarelli, Francesco Santini: Go with the -Bitcoin- Flow, with Visual Analytics . ARES 2017: 38:1-38:6 ▸ Stefano Bistarelli, Marco Mantilacci, Paolo Santancini, Francesco Santini: An end- to-end voting-system based on bitcoin . SAC 2017: 1836-1841 ▸ S. Bistarelli, A. Cretarola, G. Figà-Talamanca, I. Mercanti, and M. Patacca: Is arbitrage possible in the bitcoin market? . GECON 2018. ▸ Stefano Bistarelli, Ivan Mercanti, and Francesco Santini: An analysis of non- standard bitcoin transactions . Crypto Valley Conference 2018.

A Suite of Tools for the Forensic Analysis of Bitcoin Transactions: Preliminary Report Stefano Bistarelli, Ivan Mercanti and Francesco Santini THANKS FOR THE ATTENTION. QUESTIONS? UNIVERSITÀ DEGLI STUDI DI PERUGIA Dipartimento di Matematica e Informatica EURO-PAR 2018 WS FPDAPP 28-08-2018