【Author】
Wu, Yan; Luo, Anthony; Xu, Dianxiang
【Source】DIGITAL INVESTIGATION
【Abstract】Bitcoin as a popular digital currency has been a target of theft and other illegal activities. Key to the forensic investigation is to identify bitcoin addresses involved in the bitcoin transfers. This paper presents a framework, FABT, for forensic analysis of bitcoin transactions by identifying suspicious bitcoin addresses. It formalizes the clues of a given case as transaction patterns defined over a comprehensive set of features. FABT converts the bitcoin transaction data into a formal model, called Bitcoin Transaction Net (BTN). The traverse of all bitcoin transactions in the order of their occurrences is captured by the firing sequence of all transitions in the BTN. When analyzing transaction flows, FABT exploits the notion of bitcoin fluid to track where the bitcoins passed through given addresses (called dyeing addresses) have flown and determine the extent to which each of the other addresses is related to the dyeing addresses. The splitting, merging, and dyeing operators are used to capture the distribution of coins throughout transaction flows. FABT also applies visualization techniques for further analysis of the suspicious addresses. We have applied FABT to identify suspicious addresses in the Mt.Gox case. A subgroup of the suspicious addresses has been found to share many characteristics about the received/transferred amount, number of transactions, and time intervals. (C) 2019 Elsevier Ltd. All rights reserved.
【Keywords】Blockchain; Bitcoin; Forensic analysis; Pattern matching
【摘要】比特币作为一种流行的数字货币，一直是盗窃和其他非法活动的目标。法医调查的关键是识别比特币交易中涉及的比特币地址。本文提出了一个通过识别可疑比特币地址对比特币交易进行法医学分析的框架，即FABT。它将给定情况的线索形式化为在一组全面的特性上定义的事务模式。FABT将比特币交易数据转换成一个正式的模型，称为比特币交易网络(BTN)。所有比特币交易按发生顺序的遍历由BTN中所有转换的触发序列捕获。在分析交易流时，FABT利用比特币流动的概念来跟踪比特币经过给定地址(称为染色地址)的位置，并确定每个其他地址与染色地址的关联程度。分拆、合并和染色操作人员被用来捕获整个交易流程中的硬币分布。FABT还应用可视化技术来进一步分析可疑地址。我们已经在Mt.Gox案件中使用了FABT来识别可疑地址。已发现一组可疑地址具有许多关于接收/转移金额、交易数量和时间间隔的特征。(C) 2019爱思唯尔有限公司保留所有权利。
评论