Source-linked AI summary
Anomaly Detection in Bitcoin Network Using Unsupervised Learning Methods
Thai Pham, Steven Lee
TL;DR
The paper asks how to detect suspicious users and transactions in an unlabeled Bitcoin network, where anomalous behavior serves as a proxy for suspicious activity. It applies three unsupervised methods to user and transaction graphs and reports detection of two known thefts and one known loss among 30 known cases, while limiting experiments to 100,000 data points.
Problem
The paper addresses detecting suspicious users and transactions in an anonymous, unlabeled Bitcoin transaction network to help identify anomalous or potentially illegal activity.
Method
The study applies k-means clustering, Mahalanobis distance, and unsupervised SVM to user- and transaction-node graphs, using extracted network features.
Results
The methods detected two known thefts and one known loss out of 30 known Bitcoin cases, although agreement metrics were not high.
Takeaways & Limitations
The study shows that unsupervised methods can identify potential anomalous users and transactions in the Bitcoin network.
Takeaways & Limitations
Because ν-SVM was slow without GPU-parallelized computation, experiments were limited to 100,000 data points.
Abstract
from arXiv · showhide
The problem of anomaly detection has been studied for a long time. In short, anomalies are abnormal or unlikely things. In financial networks, thieves and illegal activities are often anomalous in nature. Members of a network want to detect anomalies as soon as possible to prevent them from harming the network's community and integrity. Many Machine Learning techniques have been proposed to deal with this problem; some results appear to be quite promising but there is no obvious superior method. In this paper, we consider anomaly detection particular to the Bitcoin transaction network. Our goal is to detect which users and transactions are the most suspicious; in this case, anomalous behavior is a proxy for suspicious behavior. To this end, we use three unsupervised learning methods including k-means clustering, Mahalanobis distance, and Unsupervised Support Vector Machine (SVM) on two graphs generated by the Bitcoin transaction network: one graph has users as nodes, and the other has transactions as nodes.
1. Introduction
The paper frames anomaly detection in Bitcoin as identifying suspicious users and transactions in an anonymous, unlabeled network. It applies three unsupervised methods to user- and transaction-centered graph representations.
- Financial-network anomalies can include fraudulent transactions, motivating detection to prevent future illegal actions.
- Bitcoin anomaly detection is difficult because users and transactions are unlabeled, with no confirmation that a node conducts illicit activities.
- The study generalizes Bitcoin fraud detection to the broader problem of anomaly detection in networks.
- The authors apply k-means clustering, Mahalanobis distance, and unsupervised SVM to two Bitcoin transaction-network graphs.One graph uses users as nodes and the other uses transactions as nodes.
2. Methods
The paper represents Bitcoin activity as user and transaction graphs, extracts graph and transaction features, and applies unsupervised methods to identify anomalous nodes. K-means provides a clustering-based reference, while Mahalanobis and ν-SVM methods flag points using distributional or boundary-based criteria.
- The analysis uses Bitcoin transaction data to construct a user graph and a transaction graph.Users are nodes connected by transactions in the user graph; transactions are nodes connected by Bitcoin flow in the transaction graph.
- The two graph representations target suspicious users and suspicious transactions while enabling consistency checks between them.
- Each graph node receives 12 extracted features, including degree, transaction, timing, balance, creation-date, and activity-duration measures.
- k-MEANS CLUSTERING: K-means partitions feature vectors into k groups and serves as an assessment method because expected outliers should lie far from cluster centroids.
- MAHALANOBIS DISTANCE BASED METHOD: The Mahalanobis method assumes multivariate normal data, estimates distribution parameters, and flags x when p(x, bµ, bΣ) < ϵ.
- UNSUPERVISED SVM: The unsupervised SVM uses a modified soft-margin ν-SVM with a kernel to classify points outside the learned boundary as anomalies.The method uses sign(wT x −ρ), with label (−1) indicating an anomaly.
3. Evaluation Methods
Because the Bitcoin network data are unlabeled, the paper evaluates anomaly-detection methods through three complementary tests: visualization, consistency across graph representations, and checks against revealed thieves.
- The paper proposes three evaluation methods because the network data lack labels.
- Visualization Evaluation compares detected outliers’ relative distances from k-means centroids; small distances indicate inadequate methods.
- Dual Evaluation tests consistency by checking whether detected suspicious users own detected suspicious transactions.
- The dual comparison uses the top 100 user outliers and top 100 transaction outliers, then forms corresponding transaction and user sets.
- The study also checks whether roughly 30 revealed thieves and their illegal transactions appear in the detected suspicious sets.
4. Results
The paper evaluates anomaly detection on user and transaction graphs using k-means, Mahalanobis distance, and unsupervised ν-SVM methods. Detected anomalies generally lie at graph borders, and the two methods produce similar suspicious users and transactions.
- The ν-SVM method was limited to 100,000 data points because it took a long time to run without GPU-parallelized computation.
- Cross-cluster entropy was minimized at k = 7 for the user graph and k = 8 for the transaction graph, but k = 7 was used for both.
- Mahalanobis-distance anomalies appeared at plot borders, indicating that abnormal activities were usually extreme.
- The ν-SVM method used ν = 0.005 to detect anomalies in both graph representations.
- The suspicious users and transactions identified by unsupervised SVM were similar to those identified by Mahalanobis distance, usually appearing on graph borders.
5. Evaluation Results
The evaluation applies anomaly-distance metrics and compares detected cases across user and transaction graphs. Unsupervised SVM outperforms Mahalanobis on the aggregate agreement metric, while both methods identify known anomalous events.
- Evaluation metrics: 0.7619 and 0.8277 are the Mahalanobis ratios for the user and transaction graphs, compared with 0.7192 and 0.8584 for Unsupervised SVM.These ratios average detected-anomaly distances relative to maximum distances from centroids for the top 100 outliers.
- Agreement metrics: 0.025633 is the Mahalanobis mDE, computed from A1 = 0.02495 and A2 = 0.026316.The paper attributes the small value to the method's simplicity and the small dataset.
- Agreement metrics: 0.14415 is the Unsupervised SVM mDE, computed from A1 = 0.1782 and A2 = 0.1101, much higher than Mahalanobis's value.The comparison remains higher despite the small dataset.
- Known cases: Mahalanobis detects a known June 2011 theft in which over 4000 BTC from 620 addresses was funneled to one address.The detected transaction is described as anomalous in the evaluation.
- Known cases: Unsupervised SVM detects a known October 2011 loss involving 23 transactions and over 2,600 BTC lost through corruption in a hashing function.The event is presented as a known loss detected by the method.
6. Future Studies
Future work proposes GPU parallelization to accelerate outlier detection and enable analysis of the full dataset of approximately 38 million transactions.
- GPU parallelization is proposed to accelerate outlier detection and support analysis of approximately 38 million transactions.Implementing this approach requires introducing thread-safety into the learning methods.
7. Conclusions
The study represents the Bitcoin network through users and transactions and applies three social network techniques to detect anomalous users and transactions. Despite low agreement metrics, it identifies two known theft cases and one known loss case among 30 known cases.
- The Bitcoin network is represented through two focuses: users and transactions.
- Three social network techniques are used to detect potentially anomalous users and transactions.
- Two known theft cases and one known loss case are detected out of 30 known cases, despite low agreement metrics.