PaperlayerView exact revision on arXiv

Source-linked AI summary

Data mining for detecting Bitcoin Ponzi schemes

Massimo Bartoletti, Barbara Pes, Sergio Serusi

arXiv:1803.00646v1cs.CR

TL;DR

Bitcoin Ponzi schemes exploit pseudonymous payments and are difficult to quantify or detect because suitable public address datasets are scarce and existing approaches depend on web searches. The paper constructs a blockchain-derived feature dataset and evaluates supervised classifiers; Random Forest correctly classifies 31 of 32 schemes with Recall 0.969. Its practical scope is constrained by Bitcoin’s fungibility, which limits ex-post countermeasures against funds from detected schemes.

  • Problem

    Public datasets of Ponzi-related Bitcoin addresses are scarce, while existing scam analyses depend on manually locating addresses, leaving scam-specific detection strategies insufficiently evaluated.

  • Method

    The paper collects and clusters Ponzi-related addresses, extracts blockchain transaction features, adds randomly chosen addresses, and evaluates supervised binary classifiers using sampling-based and cost-sensitive strategies.

  • Results

    Random Forest achieved Recall 0.969 for Ponzi schemes and correctly classified 31 of 32 schemes in the authors’ dataset.

  • Takeaways & Limitations

    The study provides a public dataset, an open-source extraction tool, comparative evaluations, and a classifier that identifies most dataset schemes with approximately 1% false positives.

  • Takeaways & Limitations

    Bitcoin’s fungibility prevents effective countermeasures against bitcoins marked as originating from Ponzi schemes until those funds leave the ecosystem through an exchange.

Abstract

from arXiv · show

Soon after its introduction in 2009, Bitcoin has been adopted by cyber-criminals, which rely on its pseudonymity to implement virtually untraceable scams. One of the typical scams that operate on Bitcoin are the so-called Ponzi schemes. These are fraudulent investments which repay users with the funds invested by new users that join the scheme, and implode when it is no longer possible to find new investments. Despite being illegal in many countries, Ponzi schemes are now proliferating on Bitcoin, and they keep alluring new victims, who are plundered of millions of dollars. We apply data mining techniques to detect Bitcoin addresses related to Ponzi schemes. Our starting point is a dataset of features of real-world Ponzi schemes, that we construct by analysing, on the Bitcoin blockchain, the transactions used to perform the scams. We use this dataset to experiment with various machine learning algorithms, and we assess their effectiveness through standard validation protocols and performance metrics. The best of the classifiers we have experimented can identify most of the Ponzi schemes in the dataset, with a low number of false positives.

I. INTRODUCTION

Bitcoin’s pseudonymous, publicly recorded transactions support proliferating Ponzi schemes, while existing detection approaches depend heavily on manually finding scam addresses. The paper constructs a labeled feature dataset and evaluates supervised classifiers, with Random Forest achieving high Ponzi recall and few false positives.

  • Motivation: Bitcoin’s pseudonymous addresses make criminal activity difficult to detect, while Ponzi schemes repay investors using funds from new participants.These schemes can proliferate and have gathered millions of dollars, according to the paper’s motivation.
  • Research gap: Existing Bitcoin-scam analyses require laborious web searches for addresses and fail when scam addresses are privately communicated or unpublished.The paper identifies this dependence as a central limitation of prior approaches.
  • Research gap: Bitcoin fraud detection remains largely unexplored for scam-specific models, with scarce public datasets limiting comparisons of strategies for real-world scenarios.Prior work had mainly addressed anomaly detection rather than learning models for specific scams such as Ponzi schemes.
  • Approach: The paper collects and clusters Ponzi-related Bitcoin addresses, extracts transaction-based features, adds 6400 random addresses, and frames detection as binary classification.Features include transferred-value statistics, inequality measures, and activity measures; the dataset contains 6432 clusters.
  • Results: Random Forest achieved Recall 0.969 for Ponzi schemes, correctly classifying 31 of 32 schemes in a dataset with one fraud per 200 non-fraud cases.The study also compares sampling-based and cost-sensitive approaches because the Ponzi class is rare and costly to miss.
  • Contributions: The contributions include a public dataset, an open-source blockchain extraction tool, systematic learning-strategy comparisons, independent evaluation, and discriminating-feature estimates.The best classifier identified most schemes with a low number of false positives.

II. BITCOIN IN A NUTSHELL

Bitcoin transfers are authorized by cryptographic keys, recorded as transactions on a public immutable blockchain, and validated by miners. Transactions reference earlier outputs, specify scripts and values, and may include fees and multiple inputs or outputs.

  • Bitcoin basics: Bitcoin users control addresses identified by public keys and authorize payments with private keys, while transactions record transfers on the immutable public blockchain.Users may generate fresh addresses for transactions to improve privacy.
  • Mining: Miners maintain blockchain copies, validate transactions, and append blocks by solving cryptographic puzzles adjusted to target one block every 10 minutes.Successful miners receive newly generated bitcoins and transaction fees.
  • Transactions: Each transaction contains inputs, witnesses, output scripts, and values; inputs reference outputs from earlier transactions to redeem them.Output scripts act as predicates evaluated using information supplied by redeeming witnesses.
  • Transactions: A transaction can combine multiple unspent outputs and distribute value to recipients, with the input-output difference paid as a miner fee.The illustrated transactions show one-input and two-input redemption patterns.
  • Transactions: Bitcoin transactions can include limited scripting logic, cryptographic operators, and time constraints on appending or redeeming transactions.The paper omits these advanced features because they are unnecessary for later sections.

III. DATASET CONSTRUCTION

The dataset-construction workflow collects Ponzi deposit addresses, clusters related addresses, derives classification features, and computes those features for the clustered addresses.

  • III. DATASET CONSTRUCTION: The workflow begins by collecting Bitcoin addresses through which Ponzi schemes receive investor funds.This collection step is followed by clustering and feature computation.
  • III. DATASET CONSTRUCTION: Address clustering identifies wallets that may contain hundreds of addresses before the paper derives features relevant to Ponzi classification.The resulting feature dataset is used in the subsequent evaluation section.

A. Collection of Bitcoin addresses used by Ponzi schemes

The paper gathers Ponzi deposit addresses through manual forum and website searches, extends the search with tagged-address crawling, and identifies 32 deposit addresses for its collection.

  • A. Collection of Bitcoin addresses used by Ponzi schemes: Researchers manually search Reddit and bitcointalk.org for Ponzi advertisements presented as high-yield investment programs or gambling games.Most advertisements do not directly provide deposit addresses, so the associated websites must also be visited.
  • A. Collection of Bitcoin addresses used by Ponzi schemes: A crawler expands the search to blockchain.info/tags and ranks linked websites using a dictionary of Ponzi-related terms.The approach uses tagged addresses and website content to prioritize likely Ponzi pages.
  • A. Collection of Bitcoin addresses used by Ponzi schemes: 32 Ponzi-scheme deposit addresses are identified, while address clustering can recover additional addresses for schemes using multiple or fresh deposit addresses.The collection is presented in Table I.

B. Address clustering

The paper clusters Bitcoin addresses using the multi-input heuristic, then derives transaction, timing, balance, inequality, and cluster-size features for detection.

  • Address clustering: The multi-input heuristic groups addresses appearing together as inputs in a transaction, based on the assumption that they are controlled by one user.Users may combine inputs to fund a transfer when no single unspent output is sufficient, avoiding multiple transaction fees.
  • Address clustering: The clustering analysis reports cluster size, transaction counts, and overall inflow, with transaction amounts converted to USD using the average daily exchange rate.
  • Features extraction: Address-level features include lifetime, activity days, maximum daily transactions, transferred-value inequality, total transferred value, and incoming or outgoing transaction counts.
  • Features extraction: Additional features capture incoming-to-outgoing transaction ratios, transferred-value averages and variability, reciprocal address transfers, timing delays, balance changes, and cluster size.Cluster features are formed by composing pointwise address features, with the number of addresses treated as an additional componentwise feature.

D. Dataset construction

The dataset represents Bitcoin-address clusters as labelled feature tuples, combining 32 Ponzi instances with 6400 randomly selected non-Ponzi instances.

  • Dataset construction: Each dataset instance is a cluster of Bitcoin addresses represented by extracted features and a binary class label, P for Ponzi or nP for other.The instances are computed using an open-source blockchain-analytics tool.
  • Dataset construction: The dataset contains 32 Ponzi instances and 6400 randomly chosen non-Ponzi instances, approximately one Ponzi instance per 200 non-Ponzi instances.The imbalance is intended to reflect the extreme rarity of Ponzi-related addresses relative to non-Ponzi ones.

IV. DATA MINING FOR PONZI SCHEMES

The paper formulates Ponzi detection as supervised binary classification under severe class imbalance and evaluates both sampling-based and cost-sensitive strategies.

  • Data mining for Ponzi schemes: The detection task distinguishes Ponzi from non-Ponzi class instances in a supervised binary-classification setting.
  • Data mining for Ponzi schemes: Class imbalance makes robust learning of the rare Ponzi class difficult because classifiers minimizing total errors can be overwhelmed by the majority class.
  • Data mining for Ponzi schemes: Correctly classifying Ponzi instances is prioritized because misclassifying fraudulent cases usually costs more than misclassifying legitimate cases.
  • Data mining for Ponzi schemes: The study considers sampling-based methods, including random undersampling and random oversampling, alongside cost-sensitive learning using class-dependent penalties.Oversampling can increase overfitting risk, particularly with noisy data.
  • Data mining for Ponzi schemes: The experiments also include learners designed to cope partly with imbalanced class distributions, such as RIPPER.

B. Classifiers

The study compares RIPPER, Bayes Network, and Random Forest classifiers, using imbalance-aware performance metrics and iterative cross-validation to assess detection models.

  • Classifiers: The induction stage evaluates RIPPER, Bayes Network, and Random Forest as representatives of different learning strategies.
  • Classifiers: RIPPER greedily learns and prunes classification rules, while Bayes Network models conditional dependencies among features and the target class.
  • Classifiers: Random Forest aggregates predictions from multiple decision trees trained on random data variants to reduce sensitivity to the training-set composition.
  • Performance measures and validation: The reported metric definitions distinguish correctly classified positives and negatives from false positives and negatives, including recall, precision, F-measure, G-mean, and AUC.
  • Performance measures and validation: The ROC curve represents the trade-off between true-positive and false-positive rates, with better models having AUC closer to 1.
  • Performance measures and validation: Because accuracy can conceal failures on rare fraud cases, the evaluation emphasizes class-specific metrics such as specificity, recall, and precision, plus F-measure, G-mean, and AUC.For a dataset with 0.5% fraud, predicting every instance as non-fraudulent yields 99.5% accuracy while detecting no fraud.
  • Performance measures and validation: Iterative cross-validation rotates each of K equally sized folds as test data while training on the remaining K −1 folds.

D. Results

The experiments compare classifiers under no correction, random undersampling, and cost-sensitive learning for highly imbalanced Ponzi detection. Random Forest with CM20 is judged most effective because it prioritizes recall while maintaining an acceptable false-positive level.

  • Random undersampling: Undersampling improves the true positive rate, but the 1:5 setting still produces too many false positives for a satisfactory precision–recall trade-off.Random Forest recognizes 25 of 32 Ponzi schemes, while Bayes Net produces 266 false positives and RIPPER 226.
  • Cost-sensitive learning: Cost-sensitive learning assigns increasingly higher penalties to false negatives, with CM5, CM10, CM20, and CM40 using ratios of 5, 10, 20, and 40 respectively.These matrices explicitly prioritize avoiding missed Ponzi schemes over false alarms.
  • Cost-sensitive learning: Random Forest performs best under cost-sensitive learning: CM5 yields 25 true positives and 13 false positives, while CM20 yields 31 and 77.CM10 yields 29 true positives and 26 false positives; CM40 does not increase true positives and raises false positives to 132.
  • Model selection: CM20 provides the strongest recall-oriented balance for Random Forest, with better G-mean and the highest AUC, so it is considered the most effective setting.Accuracy is highest with CM5, but recall is optimized with CM20 because detecting Ponzi schemes is prioritized.

E. Application of the induced model

The selected Random Forest model with CM20 is tested on an independently collected set of Ponzi schemes and randomly chosen Bitcoin addresses. It recognizes most of the new schemes while producing a reported number of false positives.

  • Independent validation: The ex-post validation collects 20 additional Ponzi schemes that gathered more than 15 millions USD overall.The new collection is assembled using the same web-search methodology as the original dataset.
  • Independent validation: The alternative dataset combines features from the new Ponzi clusters with 4000 randomly chosen Bitcoin addresses outside the original dataset.The Random Forest classifier with CM20 is applied to this alternative dataset.
  • Independent validation: 18 of 20 Ponzi schemes are recognized, with 81 false positives, when Random Forest with CM20 is applied to the independent dataset.Two Ponzi schemes are not recognized by the classifier.

F. Ranking and evaluation of features

The paper ranks cluster features for discriminating Ponzi schemes and evaluates classifiers under baseline, undersampling, and cost-sensitive settings.

  • Classifier evaluation: Baseline confusion matrices compare RIPPER, Bayes Net, and Random Forest before sampling or cost-sensitive adjustments.The matrices encode actual classes by rows and predicted classes by columns.
  • Cost-sensitive evaluation: Cost-sensitive experiments compare CM5, CM10, CM20, and CM40, which penalize false negatives at progressively higher rates than false positives.The resulting classifier confusion matrices are reported across these cost matrices.
  • Feature ranking: The most discriminating features include outgoing-value inequality, transaction ratios, outgoing-value statistics, address-flow reciprocity, and cluster activity measures.These features were selected because they appeared most often near the top of multiple ranking methods.

V. CONCLUSIONS

The paper presents supervised learning for automatic Bitcoin Ponzi-scheme analysis, motivated by the scale and difficulty of tracking illicit flows. Its best classifier correctly identifies 31 of 32 schemes with approximately 1% false positives, while deployment at blockchain scale and post-detection intervention remain challenging.

  • Motivation: Bitcoin’s public ledger enables analysis, but illicit flows are difficult to track because transactions are numerous, legitimate activity dominates, and criminals can obscure provenance.Ponzi schemes in the dataset average approximately 1400 transactions, making manual inspection impracticable.
  • Approach: The study constructs a Bitcoin Ponzi-scheme dataset from 32 known addresses, expands them to 1211 clustered addresses, and compares them with 6400 randomly chosen addresses.The identified Ponzi addresses collectively received approximately 10 million USD in investments.
  • Results: The best classifier correctly classifies 31 Ponzi schemes out of 32 while producing approximately 1% false positives.The authors report this as the strongest result among their supervised-learning experiments.
  • Limitations and future work: Applying the classifier across the entire Bitcoin blockchain poses serious efficiency issues because several dozens of millions of distinct addresses have been used.Automated checks of false positives would also be needed, potentially using web forums or network-monitoring data.
  • Extensions: The classifier could be extended to Ethereum and other cryptocurrency frauds, but each new fraud type requires constructing a suitable dataset and potentially adding behavior-specific features.The paper specifically mentions ransomware and money laundering as possible targets.
  • Limitations and future work: Bitcoin’s fungibility limits post-detection countermeasures because users and exchanges do not selectively accept or reject individual bitcoins.Risk scores may not support intervention until flagged bitcoins leave the ecosystem through an exchange service.
Loading 1803.00646v1…