Threat Level Analysis of Bitcoin Address Based on v3 Onion Domain Name

doi:10.19678/j.issn.1000-3428.0066649

Abstract

Abstract:

Bitcoin can be exchanged without revealing the user's identity, making it the main way for criminals to engage in illegal activities on the dark Web. To track illegal Bitcoin transactions, traditional methods use the pseudo anonymity of Bitcoin to perform heuristic address clustering on the entire blockchain, without fully utilizing the information of Bitcoin addresses on the dark Web. In 2021, Tor officially launched the v3 onion domain name, making the previous v2 onion domain name data no longer a basis for analysis. In response to this challenge, an integrated analysis framework called threat-level analysis framework for Bitcoin addresses based on v3 onion domain names TLAFDB is proposed. This framework enables the assessment of the threat level associated with Bitcoin addresses using v3 onion domain names. Information collection module uses overseas servers to solve regional restrictions and sets socks5h agents to support the operation of dark Web crawlers. It crawls through the dark web using onion seed addresses to collect the latest v3 onion domain name data.Information cleaning module uses regular expressions that can simultaneously cover Base58 and Bech32 encoding to extract Bitcoin addresses from the v3 onion domain name webpage, through the blockchain search engine, Blockchain.com, Bitcoin addresses with real transactions are filtered and their association with the v3 onion domain name is established.Information analysis module uses a combination of manual analysis and keyword matching to classify v3 onion domain names, assign their associated Bitcoin address categories and popularity, and determine the degree of threat. The experimental results show that TLAFDB can collect 23 627 v3 onion domain web pages, as well as extract and analyze the categories, popularity, and threat levels of 1 141 Bitcoin addresses with real transactions. In dark web, the same Bitcoin address often appears on numerous mirrored onion domain web pages, with over 95% of Bitcoin addresses being maliciously used, and the Ponzi scheme accounts for 99% of the total transaction volume of high-risk Bitcoin addresses.

Key words: dark Web, crawler, v3 onion domain name, Bitcoin address, classification

摘要：

比特币可以在不透露使用者身份的情况下进行交换，导致其成为不法分子在暗网上进行违法活动的主要方式。为了追踪比特币非法交易，传统方法根据比特币的伪匿名性，在整个区块链上进行启发式地址聚类，没有充分利用比特币地址在暗网上的信息。2021年Tor官方全面启用v3洋葱域名，使得以往的v2洋葱域名数据无法再作为分析的依据。设计并实现基于v3洋葱域名的比特币地址威胁程度的一体化分析框架TLAFDB。信息收集模块使用境外服务器解决地域限制并设置socks5h代理以支持暗网爬虫运行，使用洋葱种子地址在暗网中爬行收集最新的v3洋葱域名数据，信息清洗模块采用可同时覆盖Base58和Bech32编码的正则表达式以提取v3洋葱域名网页中的比特币地址，通过区块链搜索引擎Blockchain.com筛选存在真实交易的比特币地址，并建立其和所在v3洋葱域名的关联关系，信息分析模块采用人工分析和关键词匹配相结合的方法分类v3洋葱域名，赋予其关联的比特币地址类别和流行度并判定威胁程度。实验结果表明，TLAFDB收集了23 627个v3洋葱域名网页，提取并分析1 141个存在真实交易的比特币地址的类别、流行度和威胁程度，发现在暗网中同一个比特币地址常出现在大量的镜像洋葱域名网页上，超过95%的比特币地址被恶意使用，并且庞氏骗局交易量占高危比特币地址总交易量的99%。

关键词: 暗网, 爬虫, v3洋葱域名, 比特币地址, 分类

Jinfeng HU, Xiaoyu XU, Yunfang CHEN, Wei ZHANG. Threat Level Analysis of Bitcoin Address Based on v3 Onion Domain Name[J]. Computer Engineering, 2024, 50(3): 173-181.

胡锦枫, 徐晓瑀, 陈云芳, 张伟. 基于v3洋葱域名的比特币地址威胁程度分析[J]. 计算机工程, 2024, 50(3): 173-181.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0066649

https://www.ecice06.com/EN/Y2024/V50/I3/173

Figures/Tables 11

Fig.1 TLAFDB framework

Fig.2 Configuration steps of Tor service

Fig.3 The associated information of Bitcoin address and onion domain name

Fig.4 Classification results of support vector machine model

Fig.5 Ratio of Bitcoin address category

Fig.6 Distribution of Bitcoin address threat level

References 29

1	HURLBURT G. Shining light on the dark Web. Computer, 2017, 50(4): 100- 105. doi: 10.1109/MC.2017.110
2	KWON K H, PRINISKI J H, SARKAR S, et al. Crisis and collective problem solving in dark web: an exploration of a black hat forum[C]//Proceedings of the 8th International Conference on Social Media & Society. New York, USA: ACM Press, 2017: 1-5.
3	SAMTANI S, CHINN R, CHEN H. Exploring hacker assets in underground forums[C]//Proceedings of International Conference on Intelligence and Security Informatics. Washington D. C., USA: IEEE Press, 2015: 31-36.
4	UNODC. World drug report 2021[EB/OL]. [2022-11-25]. https://www.unodc.org/unodc/en/data-and-analysis/wdr2021.html.
5	HOELLER T, ROLAND M, MAYRHOFER R. On the state of v3 onion services[C]//Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet. New York, USA: ACM Press, 2021: 50-56.
6	DINGLEDINE R, MATHEWSON N, SYVERSON P. Tor: the second-generation onion router[C]//Proceedings of the 13th Conference on USENIX Security Symposium. New York, USA: ACM Press, 2004: 21.
7	TOR PROJECT. Tor hidden service protocol[EB/OL]. [2022-11-25]. https://community.torproject.org/onion-services/overview.
8	BIRYUKOV A, PUSTOGAROV I, WEINMANN R P. Trawling for Tor hidden services: detection, measurement, deanonymization[C]//Proceedings of Symposium on Security and Privacy. Washington D. C., USA: IEEE Press, 2013: 80-94.
9	汤艳君, 安俊霖. 基于Tor的暗网数据爬虫设计与实现. 信息安全研究, 2019, 5(9): 798- 804. URL
	TANG Y J, AN J L. Design and implementation of dark net data crawler based on Tor. Journal of Information Security Research, 2019, 5(9): 798- 804. URL
10	LI K, LIU P P, TAN Q F, et al. Out-of-band discovery and evaluation for Tor hidden services[C]//Proceedings of the 31st Annual ACM Symposium on Applied Computing. New York, USA: ACM Press, 2016: 2057-2062.
11	BERNASCHI M, CELESTINI A, GUARINO S, et al. Spiders like onions: on the network of Tor hidden services[C]//Proceedings of the World Wide Web Conference. New York, USA: ACM Press, 2019: 105-115.
12	PERERA I, BOSHMAF Y. Dizzy: large-scale crawling and analysis of onion services[C]//Proceedings of International Conference on Intelligence and Security Informatics. Washington D. C. , USA: IEEE Press, 2022: 1-10.
13	TORPROJECT. Tor rendezvous specification-version 3[EB/OL]. [2022-11-25]. https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt.
14	NAKAMOTO S. Bitcoin: a peer-to-peer electronic cash system[EB/OL]. [2022-11-25]. https://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=051480446BB56691DB1BBA726F21AA37?doi=10.1.1.221.9986&=reprep1&type=pdf.
15	REID F, HARRIGAN M. An analysis of anonymity in the Bitcoin system[EB/OL]. [2022-11-25]. https://arxiv.org/pdf/1107.4524.pdf.
16	MEIKLEJOHN S, POMAROLE M, JORDAN G, et al. A fistful of Bitcoins: characterizing payments among men with no names[C]//Proceedings of Conference on Internet Measurement. New York, USA: ACM Press, 2013: 127-140.
17	ZHENG B K, ZHU L H, SHEN M, et al. Identifying the vulnerabilities of Bitcoin anonymous mechanism based on address clustering. Science China Information Sciences, 2020, 63(3): 1- 15.
18	ZHANG Y H, WANG J, LUO J. Heuristic-based address clustering in Bitcoin. IEEE Access, 2020, 8, 210582- 210591. doi: 10.1109/ACCESS.2020.3039570
19	HE X, HE K T, LIN S W, et al. Bitcoin address clustering method based on multiple heuristic conditions. IET Blockchain, 2022, 2(2): 44- 56. doi: 10.1049/blc2.12014
20	AL JAWAHERI H, AL SABAH M, BOSHMAF Y, et al. Deanonymizing Tor hidden service users through Bitcoin transactions analysis. Computers & Security, 2020, 89, 101684.
21	DÖPMANN C, RUST S, TSCHORSCH F. Exploring deployment strategies for the tor network[C]//Proceedings of the 43rd Conference on Local Computer Networks. Washington D. C., USA: IEEE Press, 2019: 255-258.
22	JUHA N. Ahmia project[EB/OL]. [2022-11-25]. https://ahmia.fi/.
23	Onion Search Engine. Onion search engine[EB/OL]. [2022-11-25]. https://eu.onionsearchengine.com/.
24	BRANDON C. Market capitalization[EB/OL]. [2022-11-25]. https://coinmarketcap.com/charts/.
25	BLOCKCHAIN LTD. Blockchain. com[EB/OL]. [2022-11-25]. https://www.blockchain.com/explorer.
26	QAISER S, ALI R. Text mining: use of TF-IDF to examine the relevance of words to documents. International Journal of Computer Applications, 2018, 181(1): 25- 29. doi: 10.5120/ijca2018917395
27	余志玮, 何月顺. 基于Scrapy分布式的暗网探测爬虫构建. 计算机时代, 2020,(4): 21- 25. URL
	YU Z W, HE Y S. Building dark web probe crawler with Scrapy-redis. Computer Era, 2020,(4): 21- 25. URL
28	沈蒙, 桑安琪, 祝烈煌, 等. 一种基于交易图匹配的比特币异常交易实体识别方法: 111652732B[P]. 2020-09-11.
	SHEN M, SANG A Q, ZHU L H, et al. A Bitcoin anomaly transaction entity recognition method based on transaction graph matching: 111652732B[P]. 2020-09-11. (in Chinese)
29	BARTOLETTI M, PES B, SERUSI S. Data mining for detecting Bitcoin ponzi schemes[C]//Proceedings of Crypto Valley Conference on Blockchain Technology. Washington D. C., USA: IEEE Press, 2018: 75-84.

[1]	WANG Yanguo, LÜ Pengyuan, LAN Jinjiang, LIU Mingzhe, QIN Guanjun, ZHANG Shuohua, ZHOU Yu. Wind Turbine Fault Classification Method Based on Adversarial Training and Transformer [J]. Computer Engineering, 2024, 50(9): 377-384.
[2]	LI Weigang, LI Xuchang, TIAN Zhiqiang, LI Jinling. Research on Point Cloud Classification and Its Robustness Based on Self-Distillation Framework [J]. Computer Engineering, 2024, 50(9): 72-81.
[3]	LI Junyi, LI Xiangyang, LONG Chaoxun, LI Haiyan, LI Hongsong, YU Pengfei. Wild Mushroom Classification Based on Multi-level Region Selection and Cross-layer Feature Fusion [J]. Computer Engineering, 2024, 50(9): 179-188.
[4]	CAI Junmin, LIANG Zhengyou, SUN Yu, CHEN Ziao. Research on Lightweight Point Cloud Classification Based on Deformable 3D Graph Convolution [J]. Computer Engineering, 2024, 50(9): 255-265.
[5]	Han CHEN, Chunlei ZHAO, Haoda JIANG, Chundong WANG. Research on App User Intent Recognition Based on Fusion Model and Semantic Network [J]. Computer Engineering, 2024, 50(8): 50-63.
[6]	Lai QIAN, Weiwei ZHAO. Text Classification Method Based on Contrastive Learning and Attention Mechanism [J]. Computer Engineering, 2024, 50(7): 104-111.
[7]	WEI Zhuoyi, LUO Mai, LI Wenbing, ZENG Yuansong, YU Weijiang, YANG Yuedong. Intelligent Single-Cell Classification Based on Multisource Domain Adaptation [J]. Computer Engineering, 2024, 50(6): 48-55.
[8]	YAN Yinkai, PENG Ningning, YI Lisha. Skewed Time Series Classification Algorithm Based on Persistent Homology [J]. Computer Engineering, 2024, 50(6): 110-123.
[9]	SONG Qingzeng, LIU Xiangdong, XU Kangwei, LIU Jiahui, REN Erxiang, LUO Li, WEI Qi, QIAO Fei. Design of Sequential Wakeup Compute-In-Memory Controller Based on Convolutional Neural Network [J]. Computer Engineering, 2024, 50(6): 328-335.
[10]	YOU Ben, LI Xiaohong, YAO Jin, FENG Shaojie. Semi-supervised Classification for Short Text Based on Multi-grained Graphs and Attention Mechanism [J]. Computer Engineering, 2024, 50(5): 83-90.
[11]	WANG Lin, HUANG Hao. Voice Conversion Combining Vector Quantization and CTC Introducing Pre-Trained Representation [J]. Computer Engineering, 2024, 50(4): 313-320.
[12]	LI Zhengxue, LI Zhiming, PENG Dezhong, CHEN Jie. User Classification of Social Networks Based on Feature Contrastive Learning and Graph Convolution [J]. Computer Engineering, 2024, 50(4): 258-266.
[13]	Guanrong WU, Yuanxiang LI, Yilin WANG, Yuhan LU, Xiuhua CHEN. Few-Shot Metal Surface Defect Classification Based on Contrastive Learning [J]. Computer Engineering, 2024, 50(3): 36-43.
[14]	QU Kun, WANG Zhenlong, LIU Zhifeng. Cross-Entropy Ensemble Image Classification Method Based on Multi-Representation Learning [J]. Computer Engineering, 2024, 50(10): 322-333.
[15]	LIU Jiajie, LIU Guoping, HU Wenshan. Multi-Time-Series Variable Indirect Truck Lifting Detection Based on Motor Data Visualization [J]. Computer Engineering, 2024, 50(10): 370-380.

Please choose a citation manager

Content to export