A Bitcoin transaction identification method and device based on transaction mode

Abstract

The present invention discloses a method and device for identifying Bitcoin transactions based on transaction patterns. The method comprises: constructing a transaction pattern feature vector for a Bitcoin transaction to be identified; applying the constructed transaction pattern feature vector to a classifier pre-trained for a darknet market to identify whether the Bitcoin transaction is from the darknet market; wherein the classifier is pre-trained using training samples based on a semi-supervised machine learning method; wherein the training samples include positive samples and unlabeled samples; wherein the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the darknet market, as well as transactions expanded from the active Bitcoin transactions. The application of the present invention can universally identify Bitcoin transactions in various darknet markets, thereby facilitating the monitoring of various darknet markets.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for identifying Bitcoin transactions based on transaction patterns. Background Art

[0002] Bitcoin is the first decentralized, peer-to-peer cryptocurrency system, devoid of central control. Bitcoin has two key characteristics: transparency and a degree of pseudo-anonymity. Transparency means that all transactions are stored on a decentralized ledger called the blockchain, viewable by anyone who deploys the application. This degree of pseudo-anonymity is achieved by using Bitcoin addresses calculated from the user's public key; real-world identifying information, such as names, is not embedded in transactions. Bitcoin's anonymity makes transactions difficult to trace, leading to the emergence of various illegal activities within the Bitcoin ecosystem, such as darknet market transactions, money laundering, and fraud. Therefore, monitoring Bitcoin transactions on darknet markets is necessary.

[0003] Darknet markets are hidden services running on the anonymous network Tor. Since the emergence of the Silk Road darknet market, the use of Tor and Bitcoin has become standard in darknet markets. Research on darknet markets primarily focuses on two areas: 1) research related to crawling commodity transaction data from darknet market webpages; and 2) research related to identifying Bitcoin transaction patterns and detecting Bitcoin transactions and addresses in darknet markets.

[0004] However, unlike the previous situation where all dark web markets used the same software to manage Bitcoin transactions, different dark web markets no longer use the same software to manage Bitcoin transactions in order to protect anonymity. This makes it impossible to monitor all dark web markets based on existing technology.

[0005] Therefore, it is necessary to provide a method that can help monitor various dark web trading markets, that is, to be able to identify Bitcoin transactions in various dark web trading markets, that is, to have universal applicability for the identification of Bitcoin transactions in various dark web trading markets. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to propose a Bitcoin transaction identification method and device based on transaction patterns, which can be universal for identifying Bitcoin transactions in various dark web trading markets, thereby facilitating the monitoring of various dark web trading markets.

[0007] Based on the above objectives, the present invention provides a Bitcoin transaction identification method based on transaction patterns, comprising:

[0008] For the Bitcoin transaction to be identified, construct its transaction pattern feature vector;

[0009] The constructed transaction pattern feature vector is passed through a classifier pre-trained for a darknet market to identify whether the Bitcoin transaction is from the darknet market;

[0010] The classifier is pre-trained using training samples based on a semi-supervised machine learning method; the training samples include positive samples and unlabeled samples; the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the dark web trading market, as well as transactions expanded based on active Bitcoin transactions.

[0011] Optionally, the transaction pattern feature vector includes at least one or a combination of the following feature values:

[0012] Transaction fee rates;

[0013] The proportion of input addresses that begin with the set characters;

[0014] Whether the input address is the same as the output address;

[0015] Average monthly transaction count of the input address;

[0016] Enter the average monthly balance for the address;

[0017] Average lifetime of input addresses;

[0018] The number of output addresses;

[0019] The minimum monthly balance of an output address.

[0020] Optionally, the transaction expanded based on the active Bitcoin transaction is obtained specifically according to the following method:

[0021] Tracking deposit / change addresses for active Bitcoin transactions conducted on the darknet market;

[0022] If it is traced that the address appears as a change address in other subsequent Bitcoin transactions, then the other subsequent Bitcoin transactions are treated as transactions associated with the active Bitcoin transaction; and

[0023] The associated transaction is regarded as an expanded transaction.

[0024] Optionally, the transaction expanded according to the active Bitcoin transaction is further obtained according to the following method:

[0025] Matching the active Bitcoin transaction and transactions associated with the active Bitcoin transaction using a number of pre-set rules;

[0026] Determining the characteristics of Bitcoin transactions in the dark web market based on the matching results;

[0027] For Bitcoin transactions obtained from the Bitcoin blockchain, determining Bitcoin transactions with the characteristics as Bitcoin transactions in the dark web trading market;

[0028] The Bitcoin transaction identified as the dark web trading market is used as the expanded transaction.

[0029] The present invention also provides a Bitcoin transaction identification device based on transaction mode, comprising:

[0030] A feature vector construction module is used to construct a transaction pattern feature vector for a Bitcoin transaction to be identified;

[0031] An identification module is used to apply the constructed transaction pattern feature vector to a classifier pre-trained for a darknet trading market to identify whether the Bitcoin transaction is from the darknet trading market;

[0032] The classifier is pre-trained using training samples based on a semi-supervised machine learning method; the training samples include positive samples and unlabeled samples; the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the dark web trading market, as well as transactions expanded based on active Bitcoin transactions.

[0033] The present invention also provides an electronic device, comprising a central processing unit, a signal processing and storage unit, and a computer program stored in the signal processing and storage unit and executable on the central processing unit, wherein the central processing unit executes the Bitcoin transaction identification method based on transaction patterns as described above.

[0034] In the technical solution of the present invention, for each Bitcoin transaction to be identified, a transaction pattern feature vector is constructed. This constructed transaction pattern feature vector is then applied to a classifier pre-trained for a darknet market to identify whether the Bitcoin transaction originated from that darknet market. The classifier is pre-trained using training samples based on a semi-supervised machine learning method. The training samples include positive samples and unlabeled samples. The positive samples include transaction pattern feature vectors constructed for previously active Bitcoin transactions conducted on that darknet market, as well as transactions expanded from those active Bitcoin transactions. In this way, corresponding classifiers can be trained for different darknet markets based on the characteristics of their transaction patterns. Using each classifier, Bitcoin transactions from that darknet market can be identified. By identifying Bitcoin transactions in each darknet market, the operating scale of each darknet market can be determined. This universally identifies Bitcoin transactions in each darknet market, achieving the goal of comprehensive monitoring of all darknet markets. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 A flow chart of a method for training a classifier for identifying Bitcoin transactions in a specific dark web market, provided in an embodiment of the present invention;

[0037] Figure 2 A flow chart of a method for further discovering Bitcoin transactions in the dark web trading market provided by an embodiment of the present invention;

[0038] Figure 3 A flowchart of a Bitcoin transaction identification method based on transaction mode provided by an embodiment of the present invention;

[0039] Figure 4 A block diagram of the internal structure of a Bitcoin transaction identification device based on a transaction model provided by an embodiment of the present invention;

[0040] Figure 5 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0042] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0043] Through the study of Bitcoin transaction patterns in dark web markets, the core of the method of the present invention is to summarize the transaction rules of Bitcoin transactions in dark web markets, and to screen Bitcoin transactions in dark web markets from all Bitcoin transactions in the blockchain through heuristic or machine learning methods to achieve the purpose of dark web market monitoring.

[0044] In the process of studying Bitcoin transaction patterns in darknet markets, the relevant behaviors of darknet markets are divided into the following four categories:

[0045] 1) Deposit. The darknet trading market provides users with a deposit address, and the deposited amount will be converted into the user's account balance on the platform.

[0046] 2) Internal website operations: Internal website operations directly add or subtract funds from the user’s website balance and do not involve blockchain transactions. They primarily involve operating services on the website, including buying and selling products.

[0047] 3) Funds flow. To prevent attackers from linking the identities of user transfer-in addresses and transfer-out addresses, darknet trading markets may cut off the link between user transfer-in addresses and transfer-out addresses through separation, aggregation, or even coin mixing operations to achieve anonymous transactions.

[0048] 4) Withdrawal. Users transfer their account balance to a designated Bitcoin address. Darknet marketplace users who wish to convert their account balance into Bitcoin and transfer it to their own address or wallet must submit a withdrawal request to the website. The website will process the withdrawal request, convert the user's account balance into Bitcoin, and transfer it to the user's designated withdrawal address. The darknet marketplace will deduct the applicable service fee and transfer the remaining Bitcoin to the user's designated Bitcoin address.

[0049] 5) Profit Extraction. Darknet market operators transfer profits generated from operating the darknet market to their own core Bitcoin addresses. Darknet markets act as intermediaries, primarily bridging buyers and sellers. Profits primarily come from website registration fees, service fees for selling and buying goods, and service fees for withdrawals. To protect anonymity, darknet market operators may transfer these Bitcoin profits through profit extraction after a period of operation to prevent their identities from being exposed.

[0050] Users have a variety of Bitcoin addresses with different functions in darknet trading market operations. We have sorted out the Bitcoin addresses involved in the operation of darknet trading markets:

[0051] 1) Deposit Address. Darknet marketplaces assign a deposit address to each user. To ensure anonymity, darknet marketplaces typically assign a new Bitcoin address for each deposit, known as a one-time deposit address. This one-time deposit address can only be used once, and subsequent deposits will not be recognized by the darknet marketplace: in other words, the darknet marketplace will not convert deposits to the same Bitcoin address beyond the initial deposit into its website balance. The one-time deposit address belongs to the darknet marketplace operator, effectively creating a new address in its own wallet to receive Bitcoin from a specific user. Over time, the darknet marketplace will transfer all funds from the one-time deposit address, and the address will no longer be used.

[0052] 2) User Transfer-In Address. If a darknet marketplace user wishes to deposit funds to a darknet marketplace to purchase goods or services, they must do so to the deposit address provided by the darknet marketplace. The user transfer-in address is used by darknet marketplace users to transfer funds to the platform's designated deposit address. The user transfer-in address originates from the user's own wallet.

[0053] 3) User transfer address. If a user wishes to convert their account balance on a darknet marketplace website into Bitcoin, they must submit a withdrawal request on the website and specify a transfer address. The darknet marketplace will then provide the transfer address to the user for Bitcoin transactions.

[0054] 4) Withdrawal Address: When a user initiates a withdrawal request, the darknet market platform will select a set of addresses from its own wallet address pool to transfer funds to the user's transfer address. We call these addresses the darknet market withdrawal addresses.

[0055] 5) Change address. During the withdrawal process on the darknet market, a Bitcoin change address may be generated, which we call the darknet market change address.

[0056] 6) Darknet market operator core address. The darknet market operator core address is used to extract profits generated by darknet market operations.

[0057] The identities of the owners of various types of addresses are shown in Table 1 below:

[0058] Table 1

[0059]

[0060] User transfer-in and transfer-out addresses belong to the darknet market's users. Deposit addresses, withdrawal addresses, darknet market change addresses, and the darknet market operator's core address belong to the darknet market operator. While darknet markets share a common operating model, different darknet markets exhibit distinct Bitcoin trading behaviors, resulting in variations in transaction times, transaction amounts, and other aspects.

[0061] Based on the above analysis, the technical solution of the present invention analyzes the transaction patterns of different darknet markets. For each darknet market to be analyzed, active Bitcoin transactions can be used to collect deposit and withdrawal transactions from the darknet market's Bitcoin transactions. The analysis of active Bitcoin transactions mainly involves three aspects: 1) Whether deposit transactions have a fixed transaction pattern, such as whether the deposit address can be used multiple times and the characteristics of the deposit address. 2) Whether withdrawal transactions have a fixed transaction pattern, such as whether withdrawal transactions are centrally processed and whether there is a minimum withdrawal amount. 3) Whether there is a link between deposit and withdrawal transactions. To ensure the anonymity of Bitcoin transactions, darknet markets conduct a series of transactions between deposit and withdrawal transactions to prevent attackers from linking deposit and withdrawal transactions. Transaction tracking can be used to determine whether there is a link between deposit and withdrawal transactions.

[0062] Our analysis reveals that if darknet markets exhibit specific transaction patterns across the three aforementioned dimensions, they can be detected using a semi-supervised machine learning method called PULearning (positive-unlabeled learning). PU learning addresses the problem of training a binary classifier using only positive and unlabeled data, which is perfectly suited to detecting positive darknet market Bitcoin transactions within a blockchain's unlabeled transaction dataset. Specifically, a classifier is trained using heuristic or machine learning methods based on transaction pattern feature vectors, and then used to identify Bitcoin transactions from specific darknet markets within the entire blockchain's Bitcoin transactions.

[0063] The technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0064] An embodiment of the present invention provides a method for training a classifier for identifying Bitcoin transactions in a specific dark web market, the process of which is as follows: Figure 1 As shown, the following steps are included:

[0065] Step S101: Expand other transactions based on active Bitcoin transactions conducted in the dark web trading market.

[0066] In this step, for a specific darknet market to be monitored (e.g., M), Bitcoin transactions were actively conducted within the market to obtain data on these transactions. For example, during a three-month monitoring period, M's Bitcoin transactions were collected through active Bitcoin transactions. 26 deposit operations were performed on M's darknet market, generating 26 one-time deposit addresses. 22 withdrawal requests were submitted to M's darknet market, collecting data on Bitcoin withdrawals from these 22 darknet markets. Of these 26 one-time deposit addresses, the Bitcoin balances in 24 of them were transferred after a period of time. Two addresses remained untransferred because the balances in these addresses were very low (0.0005 BTC) and were no longer used by M's darknet market.

[0067] An analysis of the Bitcoin transfers from 24 one-time deposit addresses revealed that the Bitcoin in one of these addresses was used by the M darknet market to pay for a withdrawal request we submitted. This means that the M darknet market directly uses the Bitcoin in these addresses to pay for all user withdrawal requests. During the withdrawal process, a change address is generated, which is then used to pay for withdrawals. Furthermore, periodically, the M darknet market aggregates a portion of the funds in these addresses and the Bitcoin in the change addresses generated during withdrawals into a single address in round amounts of 1 BTC (the unit of Bitcoin transaction). We tracked these aggregated transactions using OKLink, which indicates that this transaction involved coin mixing. This process likely involves the M darknet market transferring profits generated from website operations to another wallet through a coin mixing service.

[0068] Therefore, it can be assumed that the one-time deposit address and the change address generated by withdrawal processing transactions on the M darknet market belong to the same address pool of the M darknet market, and are used for two types of transactions on the M darknet market: withdrawal requests from website users and round-amount aggregation transactions. Withdrawal processing transactions generate the M darknet market's change address, which continues to participate in withdrawal processing and round-amount aggregation transactions on the website. The round-amount output address of round-amount aggregation transactions on the M darknet market may not belong to the M darknet market, but may belong to a coin mixing service.

[0069] Based on the analysis of active Bitcoin transactions, in this step, the transactions associated with the active Bitcoin transactions can be expanded according to the following method:

[0070] Tracking the recharge address of the active Bitcoin transaction conducted in the dark web trading market; if it is tracked that the address appears as a change address in other subsequent Bitcoin transactions in the dark web trading market, then treating the other subsequent Bitcoin transactions as transactions associated with the active Bitcoin transaction, obtaining data of the associated transactions; and treating the associated transactions as expanded transactions.

[0071] The method includes tracking the change address of an active Bitcoin transaction conducted in the dark web market; if the tracked address appears as a change address in other subsequent Bitcoin transactions in the dark web market, treating the other subsequent Bitcoin transactions as transactions associated with the active Bitcoin transaction, obtaining data of the associated transactions, and treating the associated transactions as expanded transactions.

[0072] For example, the one-time deposit addresses of the 24 M dark web trading markets mentioned above will be used to pay for other users' withdrawal requests later. These transactions will generate change addresses of the M dark web trading markets. By tracking these change addresses, we can find the subsequent withdrawal processing transactions that occurred at these change addresses in the M dark web trading markets as related transactions.

[0073] For example, the 22 withdrawal requests mentioned above generated 22 withdrawal processing transactions. By tracking the change addresses generated by these transactions, we can find the subsequent withdrawal processing transactions that occurred at these change addresses in the M dark web trading market as related transactions.

[0074] In other words, through the above method, we can discover some new M dark web market withdrawal processing transactions. Together with the active Bitcoin transactions in the M dark web market, a total of 56 M dark web market withdrawal request transaction data are obtained, thereby expanding the transaction data that can be used as training samples.

[0075] By observing 56 withdrawal requests from the M darknet market, we found that there are certain rules for processing withdrawal requests from the M darknet market:

[0076] (1) The M dark web trading market will announce a withdrawal processing time for the day. The M dark web trading market will process all withdrawal requests submitted by users of the M dark web trading market on that day around this announced withdrawal time.

[0077] (2) The transaction fee rate for withdrawals in the M darknet market is fixed. The calculation formula for the transaction fee rate is fee size / transaction size.

[0078] (3) Bitcoin transactions have set address types, specifically including three types of addresses: addresses starting with 1, addresses starting with 3, and addresses starting with bc. The input addresses for withdrawal transactions on the M darknet market all start with type 1.

[0079] (4) The M dark web trading market has a minimum withdrawal amount for Bitcoin.

[0080] (5) In Bitcoin transactions on the M darknet market, the same address will not appear in both the input address and output address of a withdrawal transaction.

[0081] (6) The subsequent transactions of the M change address generated by the withdrawal processing transaction of the M dark web trading market are still withdrawal transactions or lump sum aggregation transactions.

[0082] That is to say, specific dark web trading markets have specific rules, and these rules reflect the trading patterns of specific dark web trading markets.

[0083] Therefore, for the active Bitcoin transaction and the transactions associated with the active Bitcoin transaction, the Bitcoin transactions in the dark web market can be further discovered according to the transaction pattern rules of the dark web market, and expanded transactions can be obtained. The specific method flow is as follows: Figure 2 As shown, it includes the following sub-steps:

[0084] Sub-step S201: Matching the active Bitcoin transaction and transactions associated with the active Bitcoin transaction using a plurality of pre-set transaction pattern rules;

[0085] Sub-step S202: Based on the matching results, characteristics of Bitcoin transactions in the dark web market may be determined;

[0086] Sub-step S203: for the Bitcoin transactions obtained from the Bitcoin blockchain, determining the Bitcoin transactions with the characteristics as Bitcoin transactions in the dark web trading market;

[0087] Sub-step S204: The Bitcoin transaction determined to be in the dark web trading market is used as the expanded transaction.

[0088] For example, five minutes before and after the withdrawal processing time of the M dark web trading market on that day was announced, all transactions published on the website page of the Bitcoin blockchain were collected, and the collected transactions were filtered using the above rules. A total of 268 transactions were screened as expanded transactions.

[0089] Step S102: Generate training samples.

[0090] In this step, for the dark web market to be detected, the training samples generated include positive samples and unlabeled samples; wherein, the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the dark web market to be detected, as well as transactions expanded based on active Bitcoin transactions; the unlabeled samples include transaction pattern feature vectors constructed for Bitcoin transactions conducted in other dark web markets.

[0091] In addition, the unlabeled samples may also include a portion of transaction pattern feature vectors constructed for the Bitcoin exchanges in the dark web trading market to be detected.

[0092] For example, for the active Bitcoin transactions and expanded transactions of the dark web market to be detected (such as the M dark web market) obtained in step S101 above, 70% of the transactions are used as transactions in the positive sample transaction set, and 30% of the transactions are used as transactions in the unlabeled sample transaction set; in addition, Bitcoin transactions conducted in other dark web markets are also used as transactions in the unlabeled sample transaction set;

[0093] Construct a transaction pattern feature vector for each transaction in the positive sample transaction set, and use the constructed transaction pattern feature vector as a positive sample in the training sample;

[0094] A transaction pattern feature vector is constructed for each transaction in the unlabeled sample transaction set, and the constructed transaction pattern feature vector is used as an unlabeled sample in the training sample.

[0095] Specifically, the transaction pattern feature vector constructed for a Bitcoin transaction includes at least one or a combination of the following feature values: transaction fee rate, the proportion of input addresses that start with set characters, whether the input address is the same as the output address, the average monthly transaction number of the input address, the average monthly balance of the input address, the average survival time of the input address, the number of output addresses, and the minimum monthly balance of the output address.

[0096] According to the transaction pattern feature vector constructed by the Bitcoin exchange, the specific meanings of each feature value are as follows:

[0097] Transaction fee rate: the transaction fee / the transaction size (bytes);

[0098] The proportion of input addresses that begin with a set character: for example, if a transaction has three input addresses and two of them begin with 1, the characteristic value is calculated as 2 / 3;

[0099] Whether the input address is the same as the output address: A Bitcoin transaction has multiple input addresses and multiple output addresses. The feature value is calculated as follows: if the input and output have the same address, it is judged as True (value 1), and if not, it is judged as False (value 0);

[0100] Monthly average number of transactions per input address: This is the average number of transactions per input address between the fifteen days before and the fifteen days after the transaction. For example, if a transaction has three Bitcoin addresses, and the number of transactions per address within 30 days is 2, 2, and 3, respectively, then the eigenvalue is calculated as (2+2+3) / 3.

[0101] Monthly average balance of input addresses: the average transaction balance of the input addresses of the transaction from fifteen days before to fifteen days after the transaction.

[0102] Average lifespan of input addresses: The average lifespan refers to the number of days between the last transaction and the first transaction for the address.

[0103] Number of output addresses: The number of output addresses of this transaction.

[0104] Minimum monthly balance of the output address: the minimum transaction balance of the output address of this transaction from fifteen days before to fifteen days after the transaction occurs.

[0105] Step S103: using the training samples to train the classifier using a semi-supervised machine learning method based on PU Learning.

[0106] Specifically, the input to a binary classification algorithm typically consists of two sets of examples, one of which consists of positive examples of the concept to be learned, and the other of negative examples. However, the available training data is often an incomplete set of positive examples and a set of unlabeled examples, some of which are positive and some are negative. PU learning solves the problem of training a binary classifier when there is only positive and unlabeled data, a problem that uses semi-supervised learning methods. In the PU learning problem, the goal is to build an accurate binary classifier without the need to collect negative data for training.

[0107] A novel PU learning method based on bootstrap bagging iteratively trains multiple binary classifiers to distinguish known positive samples from random subsamples of an unlabeled dataset and average their predictions. This method is particularly fast when the number of positive samples is limited and the proportion of negative samples in the unlabeled dataset is small, especially when the unlabeled dataset is large. Therefore, the PU learning method mentioned in this technology is used for model training in the technical solution of the present invention.

[0108] For different dark web trading markets, corresponding classifiers can be trained respectively according to the above steps S101 to S103; each classifier can be used to identify Bitcoin transactions in the corresponding dark web trading market.

[0109] Based on the classifier trained by the above method, the embodiment of the present invention provides a Bitcoin transaction identification method based on transaction mode, the process is as follows: Figure 3 As shown, the following steps are included:

[0110] Step S301: For the Bitcoin transaction to be identified, construct its transaction pattern feature vector;

[0111] Specifically, for the Bitcoin transactions to be identified obtained from the Bitcoin blockchain, the transaction pattern feature vector constructed includes at least one of the following feature values: transaction fee rate, the proportion of input addresses starting with set characters, whether the input address has the same address as the output address, the average monthly number of transactions of the input address, the average monthly balance of the input address, the average survival time of the input address, the number of output addresses, and the minimum monthly balance of the output address.

[0112] Step S302: The constructed transaction pattern feature vector is passed through a classifier pre-trained for a dark web trading market to identify whether the Bitcoin transaction is from the dark web trading market.

[0113] Specifically, the transaction pattern feature vector constructed for the Bitcoin transaction to be identified is input into multiple classifiers trained for different darknet markets. Based on the output of each classifier, it is possible to determine whether the Bitcoin transaction originated from one of these darknet markets. By identifying Bitcoin transactions in each darknet market, the operating scale of each darknet market can be determined, achieving the purpose of darknet market monitoring.

[0114] In this way, even if different dark web trading markets no longer use the same software to manage Bitcoin transactions, the method of the technical solution of the present invention can be used to use different classifiers trained for different dark web trading markets to identify Bitcoin transactions in each dark web trading market. That is, the identification of Bitcoin transactions in each dark web trading market is universal, thereby achieving the purpose of covering the monitoring of various dark web trading markets.

[0115] Furthermore, addresses involved in detected Bitcoin transactions are classified according to the five address types mentioned above. These addresses can be flagged as participants in illegal trading activities. Tracking subsequent transactions involving these addresses can uncover more illegal Bitcoin transactions. Tracking methods primarily include clustering heuristics, user profiling based on label information, and transaction graph mining. The difficulty in tracking the addresses of darknet market operators lies in the fact that darknet transactions often utilize a large number of one-time addresses—those that receive and send Bitcoin only once. These addresses are then cleared with a single receive and send transaction and are subsequently never used again. Furthermore, because mixing services effectively obfuscate the relationship between input and output addresses, darknet markets may employ mixing services to prevent tracking when transferring Bitcoin to their own core Bitcoin addresses. This makes tracking the core Bitcoin addresses of darknet market operators difficult. For darknet market user addresses, if the user uses a wallet address, clustering heuristics can be used to identify the entities associated with these flagged addresses, further enabling monitoring of illegal activity by darknet market users. Darknet market users may also use coin mixing services to prevent tracking, but due to the high cost of coin mixing services and the lack of privacy awareness among some users, most users do not choose to use coin mixing services to prevent tracking. For darknet market users who use exchange addresses, relevant departments can obtain exchange information to link illegal addresses to user identities and make them key monitoring targets.

[0116] Based on the above-mentioned bitcoin transaction identification method based on transaction mode, the embodiment of the present invention provides a bitcoin transaction identification device based on transaction mode, the internal structure of which is as follows: Figure 4 As shown, it includes: a feature vector construction module 401, a recognition module 402;

[0117] The feature vector construction module 401 is used to construct a transaction pattern feature vector for a Bitcoin transaction to be identified;

[0118] The identification module 402 is used to use the constructed transaction pattern feature vector through a classifier pre-trained for a dark web trading market to identify whether the Bitcoin transaction is from the dark web trading market;

[0119] The classifier is pre-trained using a semi-supervised machine learning method based on PU Learning using training samples; the training samples include positive samples and unlabeled samples; the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the dark web trading market, as well as transactions expanded based on active Bitcoin transactions.

[0120] Furthermore, the Bitcoin transaction identification device based on transaction patterns provided by the embodiment of the present invention may further include: a classifier training module 403;

[0121] The classifier training module 403 is used to train the classifier using the training samples using a semi-supervised machine learning method based on PU Learning.

[0122] Specifically, the classifier training module 403 may include: a transaction expansion unit 411, a training sample generation unit 412, and a training unit 413;

[0123] The transaction expansion unit 411 is configured to track the deposit / change address of an active Bitcoin transaction conducted in the darknet market; if the address is found to appear as a change address in other subsequent Bitcoin transactions, the other subsequent Bitcoin transactions are treated as transactions associated with the active Bitcoin transaction; and the associated transactions are treated as expanded transactions;

[0124] Furthermore, the transaction expansion unit 411 can also match the active Bitcoin transactions and transactions associated with the active Bitcoin transactions using a number of pre-set rules; determine the characteristics of Bitcoin transactions in the dark web trading market based on the matching results; for Bitcoin transactions obtained from the Bitcoin blockchain, determine Bitcoin transactions with the characteristics as Bitcoin transactions in the dark web trading market; and use Bitcoin transactions determined to be in the dark web trading market as expanded transactions.

[0125] The training sample generating unit 412 is configured to use the transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted on the darknet trading market and transactions expanded based on the active Bitcoin transactions as positive samples in the training samples; and use the transaction pattern feature vectors constructed for Bitcoin transactions conducted on other darknet trading markets as unlabeled samples in the training samples;

[0126] The training unit 413 is configured to train the classifier according to the training samples.

[0127] The implementation method of the functions of each module in the above-mentioned Bitcoin transaction identification device based on transaction mode can refer to the above-mentioned Figures 1 to 3The methods in each step of the process shown will not be repeated here.

[0128] Figure 5 10 is a schematic diagram showing a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0129] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the Bitcoin transaction identification method based on transaction patterns provided in the embodiments of this specification.

[0130] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0131] The input / output interface 1030 is used to connect to an input / output module. It can be connected to a nonlinear receiver to receive information from the nonlinear receiver, enabling information input and output. The input / output module can be configured as a component within the device (not shown) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., while output devices may include a display, speaker, vibrator, indicator light, etc.

[0132] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0133] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0134] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0135] In the technical solution of the present invention, for each Bitcoin transaction to be identified, a transaction pattern feature vector is constructed. This constructed transaction pattern feature vector is then applied to a classifier pre-trained for a darknet market to identify whether the Bitcoin transaction originated from that darknet market. The classifier is pre-trained using a semi-supervised machine learning method based on PU Learning using training samples. The training samples include positive samples and unlabeled samples. The positive samples include transaction pattern feature vectors constructed for previously active Bitcoin transactions conducted on that darknet market, as well as transactions expanded from those active Bitcoin transactions. In this way, corresponding classifiers can be trained for different darknet markets based on the characteristics of their transaction patterns. Using each classifier, Bitcoin transactions from that darknet market can be identified. By identifying Bitcoin transactions in each darknet market, the operating scale of each darknet market can be determined. This universally identifies Bitcoin transactions in each darknet market, achieving the goal of comprehensive monitoring of all darknet markets.

[0136] The computer-readable media of this embodiment include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0137] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Within the scope of the present invention, the above embodiments or technical features in different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0138] In addition, to simplify the description and discussion, and in order not to obscure the present invention, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, devices may be shown in the form of block diagrams to avoid obscuring the present invention, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the present invention is to be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those skilled in the art that the present invention may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0139] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0140] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A Bitcoin transaction identification method based on transaction patterns, characterized in that: include: For a Bitcoin transaction to be identified, construct a transaction pattern feature vector; wherein the transaction pattern feature vector includes at least one or a combination of the following feature values: transaction fee rate; the proportion of input addresses that begin with a set character; whether an input address is the same as an output address; the average monthly number of transactions of the input address; the average monthly balance of the input address; the average lifetime of the input address; the number of output addresses; and the minimum monthly balance of the output address. The constructed transaction pattern feature vector is passed through a classifier pre-trained for a darknet market to identify whether the Bitcoin transaction is from the darknet market; The classifier is pre-trained using training samples based on a semi-supervised machine learning method; the training samples include positive samples and unlabeled samples; the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the dark web trading market, and transactions expanded based on active Bitcoin transactions; the unlabeled samples include transaction pattern feature vectors constructed for Bitcoin exchanges conducted in other dark web trading markets; in addition, the unlabeled samples also include a portion of transaction pattern feature vectors constructed for Bitcoin exchanges in the dark web trading market to be detected.

2. The method according to claim 1, characterized in that The transaction expanded based on the active Bitcoin transaction is specifically obtained according to the following method: Tracking deposit / change addresses for active Bitcoin transactions conducted on the darknet market; If it is traced that the address appears as a change address in other subsequent Bitcoin transactions, then the other subsequent Bitcoin transactions are treated as transactions associated with the active Bitcoin transaction; and The associated transaction is regarded as an expanded transaction.

3. The method according to claim 2, characterized in that The transaction expanded based on the active Bitcoin transaction is also obtained according to the following method: Matching the active Bitcoin transaction and transactions associated with the active Bitcoin transaction using a number of pre-set rules; Determining the characteristics of Bitcoin transactions in the dark web market based on the matching results; For Bitcoin transactions obtained from the Bitcoin blockchain, determining Bitcoin transactions with the characteristics as Bitcoin transactions in the dark web trading market; The Bitcoin transaction identified as the dark web trading market is used as the expanded transaction.

4. The method according to claim 1, wherein The unlabeled samples are transaction pattern feature vectors constructed for Bitcoin transactions conducted in other dark web trading markets.

5. A Bitcoin transaction identification device based on transaction mode, characterized in that: include: A feature vector construction module is used to construct a transaction pattern feature vector for a Bitcoin transaction to be identified; wherein the transaction pattern feature vector includes at least one or a combination of the following feature values: transaction fee rate; the proportion of input addresses that begin with a set character; whether an input address is the same as an output address; the average monthly number of transactions of the input address; the average monthly balance of the input address; the average lifespan of the input address; the number of output addresses; and the minimum monthly balance of the output address. An identification module is used to apply the constructed transaction pattern feature vector to a classifier pre-trained for a darknet trading market to identify whether the Bitcoin transaction is from the darknet trading market; The classifier is pre-trained using training samples based on a semi-supervised machine learning method; the training samples include positive samples and unlabeled samples; the positive samples include transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted in the dark web trading market, and transactions expanded based on active Bitcoin transactions; the unlabeled samples include transaction pattern feature vectors constructed for Bitcoin exchanges conducted in other dark web trading markets; in addition, the unlabeled samples also include a portion of transaction pattern feature vectors constructed for Bitcoin exchanges in the dark web trading market to be detected.

6. The device according to claim 5, characterized in that Also includes: A classifier training module is used to train the classifier based on a semi-supervised machine learning method using the training samples.

7. The device according to claim 6, characterized in that The classifier training module specifically includes: A transaction expansion unit is configured to track a deposit / change address of an active Bitcoin transaction conducted in the darknet market; if the address is found to appear as a change address in a subsequent Bitcoin transaction, the subsequent Bitcoin transaction is treated as a transaction associated with the active Bitcoin transaction; and the associated transaction is treated as an expanded transaction; a training sample generating unit, configured to use transaction pattern feature vectors constructed for active Bitcoin transactions previously conducted on the darknet trading market, and transactions expanded based on the active Bitcoin transactions, as positive samples in the training samples; and to use transaction pattern feature vectors constructed for Bitcoin transactions conducted on other darknet trading markets as unlabeled samples in the training samples; A training unit is used to train the classifier according to the training samples.

8. The device according to claim 7, characterized in that The transaction expansion unit is further configured to match the active Bitcoin transaction and transactions associated with the active Bitcoin transaction using a number of pre-set rules; determine the characteristics of Bitcoin transactions in the dark web market based on the matching results; for Bitcoin transactions obtained from the Bitcoin blockchain, determine Bitcoin transactions with the characteristics as Bitcoin transactions in the dark web market; and use Bitcoin transactions determined to be in the dark web market as expanded transactions.

9. An electronic device comprising a central processing unit, a signal processing and storage unit, and a computer program stored in the signal processing and storage unit and executable on the central processing unit, characterized in that: When the central processing unit executes the program, the method according to any one of claims 1 to 4 is implemented.

Images