A method for identifying ransomware addresses in UTXO model blockchains

Abstract

This invention belongs to the blockchain field, specifically a ransomware address identification method for UTXO model blockchains. The invention includes: extracting transaction features of the addresses themselves based on ransomware activity; innovatively defining four transaction relationships and aggregating related address features to construct cascaded transaction features; utilizing a positive sample unlabeled learning method to reduce the impact of data imbalance and constructing a ransomware address identification model; and rapidly updating address features to achieve timely early warning of ransomware activities. This invention can efficiently and accurately identify blockchain addresses used for ransomware activities in UTXO model blockchains, assisting in blockchain supervision and combating illegal activities. This invention also provides a reference for ransomware address identification schemes in other payment networks. By customizing the extraction of transaction features, ransomware address identification schemes for different payment networks can be designed, which is beneficial for combating rampant and highly harmful ransomware activities in blockchains and has excellent application prospects.

Description

Technical Field

[0001] This invention belongs to the field of blockchain technology, specifically relating to a ransomware address identification method for UTXO model blockchains. Background Technology

[0002] Blockchain provides a decentralized, anonymous payment mechanism, enabling ransomware operators to collect ransoms without fear of being traced. Consequently, ransomware activity has become increasingly rampant since blockchain was introduced. For example, in 2017, the global ransomware WannaCry compromised over 300,000 computers in 150 countries with encrypted files, requiring victims to pay between $300 and $600 to three blockchain addresses hardcoded in the ransomware files. On June 9, 2021, Meatpacker JBS USA paid the equivalent of $11 million in ransom via blockchain after a cyberattack disrupted the company's operations in North America and Australia. This demonstrates that the emergence of blockchain has significantly contributed to the rampant ransomware activity. Due to the anonymity of blockchain, a large number of ransomware addresses remain undisclosed and unidentified. Therefore, mining more ransomware addresses to better measure ransom payments and their overall economic impact is a crucial issue of critical social importance.

[0003] Unlike the account model of banks, the UTXO model blockchain system uses an Unused Transaction Output (UTXO) transaction model to protect user privacy and prevent double-spending. For user convenience, UTXOs can be combined and split through transactions to make payments in any denomination. Therefore, a UTXO model blockchain transaction can have multiple inputs and outputs, where each input or output is actually a UTXO. Compared to the one-to-one transaction format in the account model, the multiple input and output transaction format of the UTXO model blockchain reveals more complex transaction relationships between UTXO model blockchain addresses. In-depth analysis of these transaction relationships helps identify ransomware addresses within the UTXO model blockchain. Summary of the Invention

[0004] The purpose of this invention is to address the problem that extortion criminals use blockchain to collect and transfer ransoms in order to conceal their true identities and the whereabouts of funds, and to provide an efficient and accurate ransom address identification method for UTXO model blockchains.

[0005] The ransomware address identification method for UTXO model blockchains provided by this invention includes the following steps:

[0006] Step 1: Extract the transaction characteristics of the address itself

[0007] To summarize the transaction behavior characteristics of ransomware activities, we first extracted historical transaction data from the target addresses. Based on this data, we extracted 18 transaction features of the addresses themselves from three perspectives: transaction quantity, transaction amount, and UTXO model. These are detailed in Table 1.

[0008] Table 1. Transaction characteristics of the address itself

[0009]

[0010]

[0011] Step 2: Determine the cascading transaction characteristics of the transaction relationship and the extraction address.

[0012] The relevant addresses that have transacted with the target address are extracted to form a set of relevant addresses. According to the format of the UTXO transaction model, the following four transaction relationships are defined: left neighbor, right neighbor, left sibling, and right sibling. Using the following four functions: maximum value, minimum value, average value, and standard deviation function, all transaction features of the target address and relevant addresses are aggregated and concatenated to obtain the cascaded transaction features of the target address.

[0013] The specific process for determining the cascading transaction characteristics of the transaction relationship and extraction address in the above steps is as follows:

[0014] (1) Traverse the historical transaction data of the target address. Based on the multi-input multi-output format of the UTXO model transaction, define the related addresses that belong to the same side (transaction input or transaction output) as the sibling addresses and define the related addresses that do not belong to the same side as the target address as the neighbor addresses.

[0015] (2) When the target address is located on the transaction input side, its sibling address is further defined as the left sibling address, and its neighbor address is defined as the right neighbor address; when the target address is located on the transaction output side, its sibling address is further defined as the right sibling address, and its neighbor address is defined as the left neighbor address; see also Figure 2 As shown; in transaction 1, if the target address is located in the transaction output, then the address in the transaction input is the left neighbor, and the other addresses in the transaction output are the right siblings. In transaction 2, if the target address is located in the transaction input, then the other addresses in the transaction input are the left siblings, and the address in the transaction output is the right neighbor.

[0016] (3) Using the following four functions—maximum, minimum, average, and standard deviation—each transaction feature of the relevant addresses in the four sets of relationships is aggregated. For each transaction feature, the above four functions are used to calculate the four aggregation results of that feature for all relevant addresses in each set of relationships. Finally, these results are concatenated with the transaction features of the address itself to obtain the cascaded transaction features, as shown in the example below. Figure 3 As shown;

[0017] Step 3: Construct a ransomware address identification model based on PU-learning (positive sample unlabeled learning).

[0018] To address the data imbalance problem of the UTXO model blockchain address set, which has a huge total number of addresses and only three ten-thousandths of known ransomware addresses, a portion of non-ransomware address samples are randomly selected in each iteration and combined with all ransomware addresses to form a training set. The decision tree machine learning algorithm is used to learn the differences in the cascaded transaction characteristics of the two sets of addresses, establish a ransomware address identification model, and determine whether an address is involved in ransomware activities.

[0019] Step 4: Rapid feature updates and timely warnings of ransomware activities.

[0020] To address the issue that the characteristics of cascading transactions in the address chain change as the number of blockchain transactions in the UTXO model increases over time, when a new transaction is generated, the historical transaction data related to the address and the set of related addresses are updated. The updated characteristics are inferred from the original transaction characteristics and cascading transaction characteristics without recalculation. The identification model is then used to determine whether the relevant addresses show signs of participating in ransomware activities.

[0021] The specific process for rapid feature updates and timely warnings of ransomware activities outlined in the above steps is as follows:

[0022] (1) During the process of calculating the cascading transaction characteristics of an address, record the number of transactions each address participates in, the set of related addresses, and its own transaction characteristics.

[0023] (2) When a new transaction occurs, extract all addresses in the transaction and update the maximum, minimum, and summation features of each address in the previously calculated transaction features. Restore the average feature and then calculate the new average feature based on the transaction information of the new transaction.

[0024] (3) Update the cascading transaction characteristics of each address in the relevant address set. Only update the characteristic value of the corresponding transaction relationship part of the address, and update the characteristic value using the method in the previous step. No recalculation is required.

[0025] The ransomware address identification method for UTXO model blockchain provided by this invention divides relevant addresses into four groups (left neighbor, right neighbor, left sibling, and right sibling) according to the position of the target address in the transaction; then, it aggregates the transaction features of the relevant addresses into cascaded transaction features of the target address through four functions, thereby achieving more accurate extraction of transaction behavior features.

[0026] This invention supports mitigating the negative impact of the extremely small proportion of known ransomware addresses on the identification model. By leveraging the concept of PU-learning, a certain number of non-ransomware addresses are randomly selected in each iteration to form a training set together with all known ransomware addresses. Then, a tree model is used to iteratively learn the differences between the two sets of data to establish a ransomware address identification model.

[0027] This invention provides a method for rapidly updating transaction features. When calculating the transaction features and cascading transaction features at the current moment, relevant parameters are recorded. When a new transaction occurs, it is not necessary to recalculate the transaction features and cascading transaction features of the address from scratch; instead, the relevant features are quickly calculated using the already calculated features and the recorded parameters.

[0028] This invention provides a high-precision ransomware address identification method for UTXO model blockchains. First, the transaction characteristics of the ransomware address itself are extracted based on the transaction behavior characteristics of the ransomware address. Then, the transaction relationship of related addresses is determined according to the UTXO transaction format, and the cascading transaction characteristics of the addresses are aggregated. Finally, PU-learning is used to reduce the problems caused by data imbalance and a ransomware address identification model is established.

[0029] Unlike other ransomware address identification methods, this invention focuses not only on the transaction behavior characteristics of the address itself, but also on the transaction behavior characteristics of related addresses involved in the same transaction. A ransomware attack typically involves multiple addresses jointly completing the entire process of receiving, transferring, and withdrawing the ransom. It is difficult to accurately determine whether an address is a ransomware address based solely on its transaction characteristics; therefore, it is necessary to consider the transaction relationships between related addresses and aggregate their transaction behavior characteristics to achieve accurate ransomware address identification.

[0030] This invention has the following technical advantages:

[0031] The ransomware address identification method proposed in this invention is highly efficient. By using a key-value database to construct an address-related transaction structure, it reduces memory usage and improves space utilization. Furthermore, it can quickly retrieve address-related transactions, reducing time consumption.

[0032] The ransomware address identification method proposed in this invention has high accuracy. On the one hand, it not only focuses on the transaction characteristics of the address itself, but also aggregates the transaction characteristics of adjacent addresses, enriching the number of features describing the transaction behavior of the address. On the other hand, it uses PU-learning to reduce the impact of data imbalance on the accuracy of the model, ensuring that the model can make accurate predictions.

[0033] The proposed solution is easy to implement and, ideally, can be completed using any programming language. Its main technical challenges lie in defining the relationship between the target address and adjacent addresses, mitigating the impact of data imbalance on the model, and timely detection in the face of continuously growing transaction data. This invention offers better solutions in both of these aspects and achieves good accuracy.

[0034] The ransomware address identification method designed in this invention can be directly applied to UTXO model blockchains. Its corresponding processing method can also provide a reference for ransomware address identification schemes in other payment networks. By customizing the extraction of transaction characteristics, ransomware address identification schemes for different payment networks can be designed. This can help combat the rampant and extremely harmful ransomware activities on UTXO model blockchains and has excellent application prospects. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating the overall process of identifying ransomware addresses.

[0036] Figure 2 Define a graph for the transaction relationships between addresses.

[0037] Figure 3 A diagram illustrating the cascading transaction feature aggregation method for addresses.

[0038] Figure 4 As an example, all transactions involving the target address are extracted, and the resulting graph is stored in a key-value database.

[0039] Figure 5 The result diagram of the transaction data obtained in the example is shown.

[0040] Figure 6 The result diagram shows the cascading transaction characteristics of the target address. Detailed Implementation

[0041] The present invention will be further described below through embodiments, but the scope of protection of the present invention is not limited to the following embodiments.

[0042] In this embodiment, the overall flowchart of the ransomware address identification method is as follows: Figure 1 As shown.

[0043] In this embodiment, a UTXO model blockchain address used by the highly dangerous ransomware family SamSam in their ransomware activities is selected as the target address: 1DxYrRu3fkqj2iLjL4a55e4n3bWAF9mBNU. In actual use, this address can be changed arbitrarily according to requirements. All transactions involving the target address are extracted and stored using a key-value database. The results are shown below. Figure 4As shown. This address participates in two transactions. The first transaction contains one transaction input and two transaction outputs, and the second transaction contains three transaction inputs and three transaction outputs.

[0044] The transaction characteristics of the target address were extracted from the transaction data, and the results are as follows:

[0045] [2,1,11.0,11.0,11.0,11.0,1,11.0,11.0,11.0,11.0,3,1,3,2,1,1,463258].

[0046] Based on the transaction data obtained in the above steps, relevant addresses are extracted, and the transaction relationships between these addresses are determined. The results are as follows: Figure 5 As shown. In the first transaction, the target address is located in the transaction output, so the addresses 3MexAsVTiadw8Sy5FGaLuM2AHUuBuPhzg8 and 3HBfFokBFsaMBYQnuCQ3E3qwEma3ADB5zD in the transaction input are left neighbors, and 368tkFV2d52J8zXHVibtqyYdLTMPiofnSd and 3NU84oXMgq26LmbQjxwzQAN6dNFdRUK9bM in the transaction output are right neighbors. In the second transaction, the target address is located in the transaction input, so the addresses 1CxzxeLyXue6qycnH8D5P6cx2nT5378cg8 and 18xZ9HEpRNe8uR41js5S6ejQ7hYh81gcc4 in the transaction output are right neighbors. In summary, the target address has two left neighbors, two right neighbors, two right siblings, and no left siblings.

[0047] Then according to Figure 3 By aggregating the transaction features of the target address and adjacent addresses using four functions, the cascaded transaction features of the target address are obtained, as shown in the following figure. Figure 6 As shown. Figure 6 The first field is the target address, followed by 18 fields representing the transaction characteristics of that target address. Subsequent fields are the aggregated results of the four sets of address transaction characteristics. Since the target address has no left sibling, all fields in the aggregated characteristics of the third relationship are 0.

[0048] After being identified by the ransomware address identification model, the model output a probability of 0.93, thus determining that the address is a ransomware address.

Claims

1. A ransomware address identification method for UTXO model blockchains, characterized in that, The specific steps are as follows: Step 1: Extract the transaction characteristics of the address itself To summarize the transaction behavior characteristics of ransomware activities, we first extracted historical transaction data from the target addresses. Based on this historical data, we extracted 18 transaction characteristics of the addresses themselves from three perspectives: transaction quantity, transaction amount, and UTXO model, as shown in Table 1 below. Table 1. Transaction characteristics of the address itself ； Step 2: Determine the cascading transaction characteristics of the transaction relationship and the extraction address. Extract the relevant addresses that have transacted with the target address to form a set of relevant addresses. According to the format of the UTXO transaction model, define the following four transaction relationships: left neighbor, right neighbor, left sibling, and right sibling. Use the following four functions: maximum value, minimum value, average value, and standard deviation function to aggregate all transaction features of the target address and relevant addresses, and concatenate them to obtain the cascaded transaction features of the target address. Step 3: Construct a ransomware address identification model based on PU-learning To address the data imbalance problem of the UTXO model blockchain having a huge total number of addresses and only three ten-thousandths of known ransomware addresses, a portion of non-ransomware address samples are randomly selected in each iteration to form a training set with all ransomware addresses. The decision tree machine learning algorithm is used to learn the differences in the cascaded transaction characteristics of the two sets of addresses and establish a ransomware address identification model to determine whether an address is involved in ransomware activities. Step 4: Rapid feature updates and timely warnings of ransomware activities. To address the issue that the characteristics of address cascading transactions may change as the number of blockchain transactions in the UTXO model increases over time, when a new transaction is generated, the historical transaction data related to the address and the set of related addresses are updated. The updated characteristics are inferred from the original transaction characteristics and cascading transaction characteristics without recalculation. The identification model is used to determine whether the relevant addresses show signs of participating in ransomware activities. The specific process for determining the cascading transaction characteristics of the transaction relationship and extraction address in step two is as follows: (1) Traverse the historical transaction data of the target address, and according to the multi-input multi-output format of the UTXO model transaction, define the related addresses that belong to the same side as the target address as sibling addresses, and define the related addresses that do not belong to the same side as the target address as neighbor addresses; the same side refers to the transaction input side or the transaction output side; (2) When the target address is located on the transaction input side, its sibling address is further defined as the left sibling address and its neighbor address is defined as the right neighbor address; when the target address is located on the transaction output side, its sibling address is further defined as the right sibling address and its neighbor address is defined as the left neighbor address. (3) Use the following four functions: maximum value, minimum value, average value and standard deviation function to aggregate each transaction feature of the relevant addresses in the four sets of relations; for each transaction feature, use the above four functions to calculate the four aggregation results of the feature for all relevant addresses in each set of relations, and finally concatenate the transaction features. The specific process for rapid feature updates and timely warnings of ransomware activities described in step four is as follows: (1) During the process of calculating the cascading transaction characteristics of an address, record the number of transactions each address participates in, the set of related addresses, and its own transaction characteristics; (2) When a new transaction occurs, extract all addresses in the transaction, update the maximum, minimum and summation features of each address in the transaction features calculated last time; restore the average feature, and then calculate the new average feature based on the transaction information of the new transaction; (3) Update the cascading transaction features of each address in the relevant address set. Only update the feature value of the corresponding transaction relationship part of the address, and update the feature value using the method in the previous step. No recalculation is required.

Images