[Paper Review] BitcoinHeist: Topological Data Analysis for Ransomware Detection on the Bitcoin Blockchain

Cüneyt Gürcan Akçora, Yitao Li+2 more|arXiv (Cornell University)|Jun 19, 2019

Topological and Geometric Data AnalysisComputer Science29 references46 citations

TL;DR

The paper presents a topological data analysis framework using Mapper on a heterogeneous Bitcoin transaction graph to automatically detect ransomware-related addresses and predict new ransomware families, achieving improved precision and recall over heuristic methods.

ABSTRACT

Proliferation of cryptocurrencies (e.g., Bitcoin) that allow pseudo-anonymous transactions, has made it easier for ransomware developers to demand ransom by encrypting sensitive user data. The recently revealed strikes of ransomware attacks have already resulted in significant economic losses and societal harm across different sectors, ranging from local governments to health care. Most modern ransomware use Bitcoin for payments. However, although Bitcoin transactions are permanently recorded and publicly available, current approaches for detecting ransomware depend only on a couple of heuristics and/or tedious information gathering steps (e.g., running ransomware to collect ransomware related Bitcoin addresses). To our knowledge, none of the previous approaches have employed advanced data analytics techniques to automatically detect ransomware related transactions and malicious Bitcoin addresses. By capitalizing on the recent advances in topological data analysis, we propose an efficient and tractable data analytics framework to automatically detect new malicious addresses in a ransomware family, given only a limited records of previous transactions. Furthermore, our proposed techniques exhibit high utility to detect the emergence of new ransomware families, that is, ransomware with no previous records of transactions. Using the existing known ransomware data sets, we show that our proposed methodology provides significant improvements in precision and recall for ransomware transaction detection, compared to existing heuristic based approaches, and can be utilized to automate ransomware detection.

Motivation & Objective

• Identify Bitcoin addresses associated with ransomware payments using scalable data-driven features.
• Assess whether a known ransomware family shows consistent blockchain behavior over time.
• Evaluate similarity of behaviors across different ransomware operators on the Bitcoin graph.
• Enable detection of undisclosed ransomware payments and emergence of new ransomware families.

Proposed method

• Model the Bitcoin blockchain as a heterogeneous, two-type graph (addresses and transactions).
• Extract six time-resolved graph features per address within 24-hour windows (income, neighbors, weight, length, count, loop).
• Formulate two problems: Existing Family Detection and New Family Prediction, using past labeled data to predict future unknowns.
• Apply Mapper-based Topological Data Analysis to produce cluster-graph representations and identify suspicious addresses via multi-attribute filtering (Algorithm 1).
• Standardize features and compare against heuristic baselines (co-spending and transition) and conventional clustering methods (DBSCAN, hierarchical, XGBoost, random forest).
• Use a 24-hour windowing approach to capture temporal and spatial transaction dynamics and to manage data at scale.

Experimental results

Research questions

• RQ1 What features from the Bitcoin network best detect ransomware behavior?
• RQ2 Does a given ransomware family exhibit consistent blockchain behavior over time?
• RQ3 How similar is the behavior of different ransomware operators on the Bitcoin blockchain?
• RQ4 Can we detect ransom payments not reported to authorities or analytics firms?
• RQ5 Can we detect the emergence of a new ransomware family from existing data?

Key findings

• The framework yields higher precision and recall for ransomware transaction detection compared to heuristic approaches.
• It can detect undisclosed payments to addresses of a known ransomware family and predict emergence of new ransomware families.
• A large ransomware dataset combining Montreal, Princeton, and Padua sources includes 24,486 addresses from 27 families with multiple appearances over time.
• Six graph features are computed per address and analyzed; top ransomware patterns differ statistically from non-ransomware patterns (p < 2.2e-16).
• Mapper-based TDA uncovers hidden connections between address clusters beyond traditional clustering, enabling targeted suspicion scoring of addresses (Algorithm 1).
• The study uses daily 24-hour windows over 2009–2018 Bitcoin data to study address recurrence and behavior.