Source-linked AI summary
Detecting Mixing Services via Mining Bitcoin Transaction Network with Hybrid Motifs
Jiajing Wu, Jieli Liu, Weili Chen, Huawei Huang, Zibin Zheng, Yan Zhang
TL;DR
Bitcoin mixing services make pseudonymous transactions harder to trace, creating a need to detect their addresses for anti-money-laundering analysis. The paper builds a feature-based network framework using AAIN, TAIN, hybrid motifs including ATH motifs, and PU learning for incomplete labels. On extremely imbalanced datasets, the PU framework achieves a true positive rate exceeding 91% and a false positive rate below 4%, while the authors note that evolving mixer behavior and limited prior labels constrain detection.
Problem
Bitcoin’s pseudonymous transactions and mixing services complicate fund tracing, motivating detection of addresses associated with mixing services for anti-money-laundering analysis.
Method
The paper builds temporal AAIN and heterogeneous TAIN networks, extracts hybrid motifs including ATH motifs, and formulates detection as PU learning using network, account, and transaction features.
Results
True positive rate exceeded 91% and false positive rate remained below 4% on extremely imbalanced datasets.
Takeaways & Limitations
Temporal and ATH motifs play an important role in mixing detection, and the proposed model supports fund tracing and crime detection in the Bitcoin ecosystem.
Takeaways & Limitations
Mixers may change their mechanisms to avoid characteristic behaviors, while the model depends on prior information in mostly unlabeled data.
Abstract
from arXiv · showhide
As the first decentralized peer-to-peer (P2P) cryptocurrency system allowing people to trade with pseudonymous addresses, Bitcoin has become increasingly popular in recent years. However, the P2P and pseudonymous nature of Bitcoin make transactions on this platform very difficult to track, thus triggering the emergence of various illegal activities in the Bitcoin ecosystem. Particularly, mixing services in Bitcoin, originally designed to enhance transaction anonymity, have been widely employed for money laundry to complicate trailing illicit fund. In this paper, we focus on the detection of the addresses belonging to mixing services, which is an important task for anti-money laundering in Bitcoin. Specifically, we provide a feature-based network analysis framework to identify statistical properties of mixing services from three levels, namely, network level, account level and transaction level. To better characterize the transaction patterns of different types of addresses, we propose the concept of Attributed Temporal Heterogeneous motifs (ATH motifs). Moreover, to deal with the issue of imperfect labeling, we tackle the mixing detection task as a Positive and Unlabeled learning (PU learning) problem and build a detection model by leveraging the considered features. Experiments on real Bitcoin datasets demonstrate the effectiveness of our detection model and the importance of hybrid motifs including ATH motifs in mixing detection.
I. INTRODUCTION
Bitcoin’s pseudonymous, decentralized transactions are difficult to trace, while mixing services obscure fund sources and can support money laundering. The paper addresses mixing detection with a feature-based network framework, ATH motifs, hybrid motifs, and PU learning for incomplete labels.
- Motivation: Bitcoin’s P2P and pseudonymous transaction structure makes activity difficult to track and contributes to illegal activity in the ecosystem.The paper motivates detection as an anti-money-laundering problem.
- Motivation: Mixing services confuse source–destination relationships by redistributing users’ funds, increasing anonymity and making illicit funds harder to trace.The paper describes mixing as originally intended to enhance transaction anonymity but also reports its use in laundering illicit profits.
- Research objective: The study detects addresses belonging to mixing services by mining public Bitcoin transaction records to characterize their transaction patterns.The stated purpose is to support subsequent investigation of users involved in criminal activities.
- Contributions: ATH motifs and hybrid motifs combining temporal homogeneous motifs with ATH motifs are proposed as important features for mixing detection.The paper presents network motifs as a novel application to Bitcoin mixing detection.
- Approach: The framework constructs AAIN and TAIN networks, extracts features at multiple levels, and trains a model to predict mixing addresses among unlabeled addresses.Its modules cover data collection, network construction, feature extraction, and model training and application.
- Contributions: The model is formulated as a PU learning problem to use labeled addresses despite imperfectly labeled datasets.The authors report high true positive and low false positive rates, facilitating fund tracing and crime detection.
II. DATA COLLECTION
The study uses WalletExplorer to obtain labels and samples Bitcoin transaction data in historical snapshots, while documenting limitations in label coverage and service representation.
- Label collection: WalletExplorer supplies address labels by observing how Bitcoin flows merge after transactions with services.Its name database was no longer updated after 2016 and therefore excludes newer emerging services.
- Transaction data: The experiments use three Bitcoin transaction snapshots collected between November 2014 and January 2016 at six-month intervals.Each snapshot contains 1,500,000 transaction records.
- Labeled services: The labeled addresses mainly represent Bitcoin Fog, BitLaunder, and Helix mixing services.The dataset documentation describes operational differences among these services, including randomized withdrawals and multiple withdrawal addresses.
- Dataset composition: The labeled addresses account for about 0.19% of all addresses appearing in the transaction data.This creates a highly imbalanced setting for model training.
III. NETWORK CONSTRUCTION AND MOTIF DEFINITION
The paper models Bitcoin transactions as temporal networks at address and transaction levels, then uses motifs to capture recurring, time-ordered interaction patterns. AAIN represents address-to-address transfers, while temporal motifs preserve edge order within a bounded time window.
- Network construction: TAIN complements AAIN by representing transactions and addresses as heterogeneous nodes, enabling transaction amounts and transfer strength to be observed more clearly.
- AAIN: AAIN models Bitcoin addresses as nodes and transactions as time-stamped directed edges between source and destination addresses.
- Temporal motifs: Temporal motifs are recurring interconnection patterns whose edges occur in nondecreasing time order within a δ-duration window.
- Temporal motifs: Unlike static motifs, temporal motifs preserve the sequence of contacts, excluding patterns with invalid edge order or excessive time span.
B. TAIN and ATH Motifs
TAIN represents typed transaction-address interactions with temporal and amount attributes, enabling ATH motifs to distinguish transaction patterns that share topology. The resulting motif and network features characterize mixing-related behavior through statistical analysis of Bitcoin transaction networks.
- TAIN: TAIN is an attributed temporal heterogeneous network with address and transaction node types, typed edges, transaction amounts, and transaction times.
- ATH motifs: ATH motifs extend local recurring subgraphs with node and edge types, mapped edge attributes, and a time-window constraint.
- ATH motifs: Attribute information distinguishes same-topology instances, including receiving first and later sending less money versus sending first and later receiving less money.
- Network features: The analysis extracts higher-order network features from both AAIN and TAIN, including temporal-motif and ATH-motif frequency proportions.
- Motif significance: Motif significance is evaluated with z-scores against randomized networks, with z-score > 2.0 treated as statistically significant; candidate patterns include a1-a6 and b2, b4-b6.
- Findings: Using δ = 3 hours, the reported findings associate mixing services with receiving first and sending later without a negative balance, less address reuse, and dispersal of tainted Bitcoins.
B. Account Features
Account features describe address state and activity through transaction counts, amounts, and their ratios. Labeled addresses show relatively consistent patterns, including near-balanced input and output amounts, whereas unlabeled addresses are more heterogeneous.
- Feature design: Account features characterize address state and activeness using transaction counts, amounts, and input-to-output ratios.The listed features include input and output transaction counts, total input and output amounts, and corresponding ratios.
- Observed patterns: Unlabeled addresses exhibit substantial variety in account features because they represent multiple address types.This variety is reflected by greater dispersion in the account-feature statistics.
- Observed patterns: Labeled addresses have comparatively smaller differences in account features, reflected by relatively low standard deviations.
- Observed patterns: For labeled addresses, output transaction amounts usually equal input amounts, whereas unlabeled addresses maintain positive net income on average.The pattern is consistent with mixing-service addresses acting as intermediaries that send out what they receive.
C. Transaction Features
Transaction features model money flow through intermediary addresses using transaction cycles and temporal interaction patterns. Mixing-service addresses tend to show near-balanced cycles, short cycle durations, and coordinated inputs that obscure funds.
- Transaction cycles: A transaction cycle is an ordered pair of continuous input and output streams describing money flowing through an intermediary address.The cycle representation tracks transaction timing and the amounts received and sent.
- Transaction cycles: Mixing-service transaction cycles are mostly completed within 3 hours, while unlabeled addresses lack the same clear timing pattern.The 3-hour observation motivated setting the motif time window δ to 3 hours.
- Transaction behavior: Mixing-service addresses have cycle balances closer to zero and more co-input than co-output addresses.The co-input pattern may reflect obfuscation of an address's coins with coins from other addresses.
V. DETECTION MODEL
The detection model addresses scarce verified positives and many unlabeled addresses with a two-stage PU-learning strategy. It first identifies reliable negatives, then trains a cost-sensitive classifier and thresholds unlabeled-address probabilities.
- PU-learning setup: Extreme class imbalance arises because only a small number of mixing-service addresses are verified while the remaining addresses are unlabeled.The imbalance can hinder ordinary supervised classification.
- Stage one: Stage one uses spy instances sampled from positives to select reliable negative instances from the unlabeled set.The default spy sample rate is 15%; the remaining positives receive label 1, while spies and unlabeled instances receive label -1.
- Stage one: The threshold θ maximizes the increment difference between cumulative probability proportions for unlabeled and spy instances.The increments are evaluated over probability steps of Δp = 0.005.
- Stage two: Stage two minimizes a weighted regularized loss to account for imbalance between positives and reliable negatives.The model uses biased logistic regression with log loss and L2 regularization, with penalty coefficients inversely proportional to class counts.
- Decision rule: An unlabeled address is detected as mixing-associated when its positive-instance probability exceeds ε.
VI. EXPERIMENTAL RESULTS
The evaluation compares the proposed detection framework with baseline methods, examines motif and basic features, tests parameter sensitivity, and considers the relevance of historical transaction snapshots.
- Evaluation design: The experiments evaluate the proposed Bitcoin mixing-service detection framework under specified experimental settings.
- Evaluation design: The proposed method is compared with several baseline methods.
- Feature analysis: The evaluation separately examines motif-based features and other basic features.
- Robustness: Parameter sensitivity analysis is used to assess framework robustness.
- Data scope: Because the experiments use three transaction snapshots from 2014–2016, the paper discusses their relevance to current transactions and addresses.
A. Experimental Settings
The experiments use Bitcoin transaction snapshots with labeled and unlabeled addresses, train the model through two stages, and evaluate it with TPR, FPR, and G-Mean.
- The model initializes the time window δ at 3 hours and the voting probability threshold ε at 0.6, averaging results over 100 experiments.
- After filtering, 131 labeled addresses and 1,635,904 unlabeled addresses are removed from the three datasets.
- Training and testing: Stage-one training uses 70% of labeled and unlabeled addresses to obtain reliable negative instances, while stage two uses reliable negatives with the labeled addresses.
- Evaluation: Testing uses the remaining 30% of reliable negatives and labeled addresses, and performance is measured by TPR, FPR, and G-Mean.
B. Method Comparison
The proposed PU-learning strategy is compared with unsupervised, supervised, and Bitcoin-specific baselines. It performs strongly, while hybrid motifs substantially improve detection quality.
- Baselines: The comparison includes OCSVM, isolation forest, logistic regression, decision tree, and InterScore as unsupervised, supervised, and Bitcoin-specific baselines.
- Baseline behavior: Unsupervised methods discover most positive instances but produce higher false positive rates, while InterScore varies substantially across datasets.
- Baseline behavior: Supervised logistic regression and decision tree methods suffer from overfitting and relatively poor performance under extreme class imbalance.
- PU learning: Selecting reliable negatives before supervised learning improves positive-instance detection and yields the best G-Mean.
- PU learning: The PU framework achieves a true positive rate exceeding 91% and a false positive rate below 4% on extremely imbalanced datasets.
- Motif features: Motifs outperform basic features, and combining temporal and ATH motifs with basic features significantly improves almost every evaluation metric.
D. Parameter Sensitivity Analysis
The analysis tests sensitivity to the time window and probability threshold. Performance remains generally stable across time-window settings, while the threshold trades off TPR against FPR.
- The sensitivity analysis varies the time window δ and probability threshold ε to assess their effects on model performance.
- Time window: The time-window analysis evaluates TPR, FPR, and G-Mean for δ values from 0.25 to 6 hours.
- Time window: The model’s metric curves are generally stable across tested time windows, indicating relatively good results under different δ settings.
- Probability threshold: Lower ε produces higher TPR, whereas larger ε produces lower FPR.
- Probability threshold: The threshold can therefore be selected according to whether an application prioritizes higher TPR or lower FPR.
E. Discussion
The discussion situates the method against evolving Bitcoin transaction technologies and related network-mining work. Results remain strongest in G-Mean on newer data, but labels and new transaction mechanisms constrain performance.
- Current Bitcoin technologies: SegWit changes transaction structure and reduces transaction size, while Lightning Network moves most channel transactions off-chain.
- Current-data evaluation: WalletExplorer lacks emerging services after 2016, so the study uses 2014–2016 snapshots and separately evaluates 1,500,000 transactions collected since March 25, 2020.
- Current-data evaluation: On the 2020 dataset, the proposed model remains best in G-Mean, although its TPR and FPR are slightly worse than those of the best method.
- Related work: The study frames motifs as recurrent subgraph patterns for characterizing mixing-service behavior and notes that prior work often omits network attributes.
- Contributions: The framework combines temporal AAIN motifs, ATH motifs in TAIN, and PU learning to characterize transaction patterns and handle extreme label imbalance.
- Limitations: The authors caution that providers may alter transaction mechanisms to avoid the motifs, while unlabeled complex strategies may remain undetected.