Tor illegal user de-anonymization method based on bitcoin transaction analysis

Abstract

The application discloses a Tor illegal user de-anonymization method based on bitcoin transaction analysis, which comprises the following steps: Tor hidden service bitcoin address discovery, hidden service data collection, bitcoin address extraction and automatic identification of Tor illegal hidden service. The Tor hidden service bitcoin address discovery collects hidden service site data by using a distributed crawler technology, extracts valid bitcoin addresses from the hidden service page by combining a bitcoin address construction principle and a regular expression; the automatic identification of Tor illegal hidden service uses machine learning to train a text multi-classification model to automatically identify Tor illegal hidden service sites; the bitcoin address acquisition obtains a Tor illegal transaction user bitcoin address set by analyzing illegal hidden service bitcoin historical transaction records; and the Tor illegal transaction user de-anonymization realizes the de-anonymization of the Tor illegal transaction user based on bitcoin wallet label data and social platform user information.

Description

Technical Field

[0001] This invention relates to a deanonymization technology, belonging to the fields of Anonymity Network and Blockchain technologies, specifically to a method for deanonymizing illegitimate Tor users based on Bitcoin transaction analysis. Background Technology

[0002] In today's era of rapid information technology development, cyber threats are also increasing rapidly, and people are paying more and more attention to privacy and anonymity on the internet. Tor, as an anonymous communication system, can effectively protect the communication relationship between clients and servers. Meanwhile, Bitcoin uses pseudonyms and non-linkability to hide the relationship between real users and Bitcoin addresses, providing anonymity for Bitcoin transactions. These characteristics have led to the large-scale use of Bitcoin in Tor illicit hiding services to conceal the identities of both parties in transactions. Therefore, the analysis of Bitcoin deanonymization is of significant research importance. Some studies have demonstrated that Bitcoin is not completely anonymous, and this anonymity deficiency makes it possible to achieve deanonymization for users of Tor illicit hiding services. Summary of the Invention

[0003] Purpose of the invention: To address the problem of large-scale use of Bitcoin in Tor illicit hidden services to conceal the identities of transacting parties, this invention proposes a method for deanonymizing Tor illicit users based on Bitcoin transaction analysis. This method collects hidden service information and extracts the Bitcoin addresses of illicit hidden services. It uses historical Bitcoin transaction records to form a set of Bitcoin addresses of Tor illicit trading users. Combining Bitcoin wallet tag data and social media user information, it associates the wallet tags and social media user identities of the Tor illicit trading users' Bitcoin addresses.

[0004] The present invention adopts the following technical solution:

[0005] A method for deanonymizing illegitimate Tor users based on Bitcoin transaction analysis, comprising the following steps:

[0006] (1) Discovering Bitcoin addresses hidden by Tor: Data on hidden service sites are collected using distributed crawling technology, and valid Bitcoin addresses are extracted from the hidden service pages by combining the principles of Bitcoin address construction and regular expressions.

[0007] (2) Automated identification of illegal hidden Tor services: Automated identification of illegal hidden Tor service sites is achieved by training a text multi-classification model using machine learning;

[0008] (3) Obtaining the Bitcoin addresses of users involved in illegal Tor transactions: By analyzing the historical transaction records of Bitcoin illegally hidden services, a set of Bitcoin addresses of users involved in illegal Tor transactions was obtained;

[0009] (4) Deanonymization of Tor illicit trading users: Deanonymization of Tor illicit trading users is achieved through Bitcoin wallet tag data and social platform user information.

[0010] Furthermore, step (1) specifically includes:

[0011] (11) Hidden service data collection: Collect the hidden service addresses provided by the Ahmia site as seed nodes, use the Scrapy-Redis distributed crawler framework to collect Tor hidden service data, extract .onion links from the crawled pages, and save the uncrawled links to the crawler task queue.

[0012] (12) Bitcoin address extraction: By analyzing the encryption algorithm, hash algorithm and encoding method involved in the Bitcoin address generation process, the string characteristics of different types of addresses are obtained. Regular expressions are designed to extract Bitcoin addresses that meet the characteristics from the hidden service page. The extracted Bitcoin addresses are decoded and verified to determine whether they are valid.

[0013] Furthermore, step (2) specifically includes:

[0014] (21) Perform data cleaning and text segmentation on the hidden service HTML document, remove scripts, style sheets and tags from the HTML document, convert the string text into a word list, and perform part-of-speech restoration and stop word removal for each word;

[0015] (22) A bag-of-words model is constructed based on preprocessed text data, the text is converted into vectors, the document frequency method is used for feature selection, and the TF-IDF weighting technique is combined to achieve feature weighting;

[0016] (23) Fine-grained classification of illegal categories of hidden services, such as drugs, black market, credit cards, etc. Other hidden services are uniformly classified as other. A text multi-classification model is trained using support vector machine, and the model is used to predict the category of hidden services.

[0017] Furthermore, step (3) specifically includes:

[0018] (31) Design a Bitcoin multi-input heuristic clustering algorithm to cluster Bitcoin addresses that are illegally hidden and obtain a larger set of Bitcoin addresses that belong to the illegal hidden services;

[0019] (32) Obtain historical transaction data of the illegal hidden service Bitcoin address set, and use all Bitcoin addresses that have transacted with the illegal hidden service Bitcoin address as the Tor illegal hidden service Bitcoin address set.

[0020] Furthermore, step (4) specifically includes:

[0021] (41) Match the collected Bitcoin addresses of users involved in illegal Tor transactions with the Bitcoin address wallet tag data provided by the WalletExplorer website;

[0022] (42) Using Google search, Twitter search, Facebook search and collecting BitcoinTalk user personal information page data, determine whether the Bitcoin address of the Tor illegal transaction user appears on Twitter, Facebook and BitcoinTalk platform.

[0023] Beneficial effects: Compared with the prior art, the significant advantages of this invention are:

[0024] 1. Proactively collect relatively secretive and illegally hidden Bitcoin addresses, automatically mark and identify illegally hidden services and their Bitcoin addresses.

[0025] 2. Design the workflow of a multi-input heuristic clustering algorithm for Bitcoin to obtain a larger set of Bitcoin addresses used for illegal Tor services. Utilize Bitcoin transaction records to collect a set of Bitcoin addresses of users involved in illegal Tor transactions.

[0026] 3. Linking the wallet tags and social media user identities of users involved in illegal Tor transactions with their Bitcoin addresses helps to deanonymize these users and facilitates the identification and tracing of illicit Tor users. Attached Figure Description

[0027] Figure 1 This is the overall design diagram of the present invention for deanonymizing Tor illegal transaction users based on Bitcoin transaction analysis.

[0028] Figure 2 This is a flowchart of the hidden service data collection process in the discovery of hidden Bitcoin addresses using Tor, as described in this invention.

[0029] Figure 3 This is a flowchart of the Bitcoin address clustering process in the Tor illegal transaction user Bitcoin address acquisition of the present invention. Detailed Implementation

[0030] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0031] This invention provides a method for deanonymizing illegitimate Tor users based on Bitcoin transaction analysis, such as... Figure 1As shown, this technology consists of four parts: discovery of Bitcoin addresses hidden by Tor services, automated identification of illegitimate Tor hidden services, acquisition of Bitcoin addresses of users involved in illegitimate Tor transactions, and deanonymization of users involved in illegitimate Tor transactions. Specifically, it includes:

[0032] 1. Discovering hidden Bitcoin addresses on Tor services

[0033] Tor's hidden service Bitcoin address discovery involves two steps: hidden service data collection and Bitcoin address extraction.

[0034] Hidden service data collection: such as Figure 2 The system collects hidden service addresses provided by the Ahmia site as seed nodes and uses the Scrapy-Redis distributed crawler framework to crawl data from Tor hidden service sites. The crawler client encapsulates the access results and site content into JSON format and sends them to the Kafka message queue. The message queue handler reads messages from Kafka. If the site access is successful, the page content is saved to the NAS storage node in HTML file format, and all .onion links are extracted from the site content. After deduplication using a Redis Bloom filter, the uncrawled links are saved to the Redis task queue.

[0035] Bitcoin Address Extraction: Bitcoin addresses can be divided into three types: P2PKH addresses, P2SH addresses, and BECH32 addresses. By analyzing the Bitcoin address generation process, the characteristics of P2PKH and P2SH addresses are found to be: (1) strings with a length of 26 to 34 characters; (2) P2PKH addresses start with "1", and P2SH addresses start with "3"; (3) BASE58 encoded strings consist of uppercase and lowercase letters and numbers, but do not include characters such as "IlO0". Characteristics of BECH32 addresses: (1) strings with a length of 42 or 62 characters; (2) addresses start with "bc1q"; (3) BECH32 encoding consists of lowercase letters and numbers, and easily confused characters are removed. Bitcoin addresses are extracted from hidden service pages by designing regular expressions. Bitcoin addresses extracted by regular expressions are not necessarily valid and need to be decoded and verified. The Bitcoin address regular expression is designed as follows:

[0036]

[0037] 2. Automated identification of illegally hidden Tor services

[0038] Tor's automated identification of illegal hidden services includes three steps: data preprocessing, text feature vectorization, and hidden service content classification.

[0039] Data preprocessing: Removing scripts, style sheets, and tags from the HTML document, resulting in text data composed of individual words, which are then converted to lowercase. The BeautifulSoup4 and lxml libraries are used to parse the HTML document, removing script tags to obtain plain text data. After data cleaning, the text string needs to be segmented into a word list. For each word, part-of-speech tagging and stop word removal are performed. The core code for data cleaning and text analysis is as follows:

[0040]

[0041] Text Feature Vectorization: A bag-of-words model is constructed based on preprocessed text data to convert text into vectors. The word frequency matrix is ​​calculated using the CountVectorizer function in the scikit-learn library, and then feature selection is performed using document frequency. After feature selection, TF-IDF weighting is used for feature weighting.

[0042] Hidden Service Content Classification: The Tor hidden services collected by the crawler are classified, with key illegal hidden services marked and other hidden services uniformly classified as "Other". A text multi-classification model is trained using support vector machines to achieve automated identification of illegal hidden services. A classifier is used to predict the presence of Bitcoin addresses on sites; if a hidden service is classified as illegal, the extracted Bitcoin address is confirmed to be the address of the illegal hidden service.

[0043] 3. Obtaining Bitcoin addresses of users involved in illegal Tor transactions

[0044] The acquisition of Bitcoin addresses of users involved in illegal transactions on Tor is mainly achieved by clustering the set of Bitcoin addresses used by Tor to illegally hide services, and then forming a list based on the historical transaction records of those addresses.

[0045] Tor's illegal hiding service for Bitcoin address clustering: The initiator of a Bitcoin transaction needs to sign all inputs in the transaction to prove that they own the Bitcoins in those addresses. When the signed transaction is broadcast to the network, Bitcoin nodes verify the signature. Therefore, the initiator must control the private keys of these input addresses and can securely assume that all addresses in the transaction input belong to a single user. Because users can hide transaction relationships by collaboratively constructing CoinJoin transactions, CoinJoin transactions are first excluded during multi-input heuristic clustering. BlockStream's CoinJoin transaction detection rules are then used for CoinJoin transaction identification. Figure 3This is a flowchart of Bitcoin address clustering. After clustering the illicit hiding service Bitcoin addresses, all Bitcoin addresses that have had transaction records with the illicit hiding service Bitcoin addresses of Tor are identified as illicit Tor transaction user Bitcoin addresses.

[0046] 4. Deanonymization of Tor users involved in illicit transactions

[0047] Tor's deanonymization of users involved in illicit transactions involves two steps: associating Bitcoin addresses with wallet tags and associating Bitcoin addresses with social identities.

[0048] Bitcoin Address Wallet Tag Association: This involves matching collected Bitcoin addresses from users involved in illicit Tor transactions with Bitcoin address wallet tag data provided by the WalletExplorer website. WalletExplorer tags the wallet names of some Bitcoin addresses, categorizing them into five groups: Exchanges, Pools, Services / others, Gambling, and Old / historic. For regulators, obtaining the Bitcoin address wallet tags of users involved in illicit Tor transactions could potentially allow them to contact the wallet service providers and obtain user identity information associated with those Bitcoin addresses.

[0049] Linking Bitcoin Addresses to Social Identity: Users may publish their Bitcoin addresses on various social media platforms for different purposes, such as receiving donations or providing services. When analyzing Bitcoin transaction chains, information such as phone numbers, email addresses, genders, and residential addresses can be retrieved based on these publicly disclosed Bitcoin addresses. Analyzing and manually verifying records of Bitcoin addresses appearing on platforms like Twitter, Facebook, and BitcoinTalk allows for the linking of Bitcoin addresses used in illicit Tor transactions to the identities of users on these social media platforms. The following three methods can be used to query Bitcoin addresses used in illicit Tor transactions on these platforms:

[0050] 1. Google Search offers an advanced search function, "keyword site:xxx.com," which can be used to find records of Bitcoin addresses appearing on sites such as Twitter, Facebook, and BitcoinTalk.

[0051] 2. Data was collected from BitcoinTalk users' personal information pages, where some users had filled in their personal Bitcoin addresses;

[0052] 3. By using the keyword search function of platforms such as Twitter and Facebook, searching for Bitcoin addresses as keywords can yield posts related to those Bitcoin addresses.

[0053] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit its protection scope. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading this application, they can still make various changes, modifications or equivalent substitutions to the specific implementation of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims pending approval.

Claims

1. A method for deanonymizing illegitimate Tor users based on Bitcoin transaction analysis, characterized in that, The method includes the following steps: (1) Discovering Bitcoin addresses hidden by Tor: Data on hidden service sites are collected using distributed crawling technology, and valid Bitcoin addresses are extracted from the hidden service pages by combining the principles of Bitcoin address construction and regular expressions. Step (1) specifically includes: (11) Hidden service data collection: Collect the hidden service addresses provided by the Ahmia site as seed nodes, use the Scrapy-Redis distributed crawler framework to collect Tor hidden service data, extract .onion links from the crawled pages, and save the uncrawled links to the crawler task queue. (12) Bitcoin address extraction: By analyzing the encryption algorithm, hash algorithm and encoding method involved in the Bitcoin address generation process, the string characteristics of different types of addresses are obtained. Regular expressions are designed to extract Bitcoin addresses that meet the characteristics from the hidden service page. The extracted Bitcoin addresses are decoded and verified to determine whether they are valid. (2) Automated identification of illegal hidden Tor services: Automated identification of illegal hidden Tor service sites is achieved by training a text multi-classification model using machine learning; Step (2) specifically includes: (21) Perform data cleaning and text segmentation on the hidden service HTML document, remove scripts, style sheets and tags from the HTML document, convert the string text into a word list, and perform part-of-speech restoration and stop word removal for each word; (22) A bag-of-words model is constructed based on preprocessed text data, the text is converted into vectors, the document frequency method is used for feature selection, and the TF-IDF weighting technique is combined to achieve feature weighting; (23) Fine-grained classification of illegal categories of hidden services, training of text multi-classification model using support vector machine, and prediction of hidden service categories using the model; (3) Obtaining the Bitcoin addresses of users involved in illegal Tor transactions: By analyzing the historical transaction records of Bitcoin illegally hidden services, a set of Bitcoin addresses of users involved in illegal Tor transactions was obtained; Step (3) specifically includes: (31) Design a Bitcoin multi-input heuristic clustering algorithm to cluster Bitcoin addresses that are illegally hidden and obtain a larger set of Bitcoin addresses that belong to the illegal hidden services; (32) Obtain historical transaction data of the illegal hidden service Bitcoin address set, and take all Bitcoin addresses that have transacted with the illegal hidden service Bitcoin address as the Tor illegal hidden service Bitcoin address set; (4) Deanonymization of Tor illicit trading users: Deanonymization of Tor illicit trading users is achieved through Bitcoin wallet tag data and social platform user information; Step (4) specifically includes: (41) Match the collected Bitcoin addresses of users involved in illegal Tor transactions with the Bitcoin address wallet tag data provided by the WalletExplorer website; (42) Using Google search, Twitter search, Facebook search and collecting BitcoinTalk user personal information page data, determine whether the Bitcoin address of the Tor illegal transaction user appears on Twitter, Facebook and BitcoinTalk platform.

Images