论文标题
观看您的背景：通过来回探索确定比特币中的网络犯罪关系
Watch Your Back: Identifying Cybercrime Financial Relationships in Bitcoin through Back-and-Forth Exploration
论文作者
论文摘要
网络犯罪分子通常利用比特币进行非法活动。在这项工作中，我们提出了来回探索，这是一种新型的自动比特币交易追踪技术，以识别网络犯罪财务关系。给定属于网络犯罪活动的种子地址，它输出了交易图，并确定了与研究中的活动与外部服务与其他网络犯罪活动之间关系相对应的路径。来回探索提供了两个关键贡献。首先，它既探索前进又向后探索，而不仅仅是通过先前工作所做的那样向前探索，从而可以发现仅通过探索向前（例如，来自混音器的客户的存款）而无法找到的关系。其次，它通过将标记数据库与机器学习分类器相结合，以识别属于交换的地址，从而防止图形爆炸。我们评估了30个恶意软件系列的来回探索。我们使用比特币为C＆C建造了4个家庭的oracles，并使用它们来证明来回探索标识了13 C＆C信号地址所遗漏的13 C＆C信号地址，其中8个从根本上被前瞻性探索遗漏了。我们的方法揭示了恶意软件使用的大量服务，包括44个交易所，11个赌博网站，5个付款服务提供商，4个地下市场，4个采矿池和2个混音器。在4个家庭中，该关系包括仅远前探索所遗漏的新归因点。它还确定了恶意软件家族与其他网络犯罪活动之间的关系，强调了一些恶意软件运营商如何参与各种网络犯罪活动。
Cybercriminals often leverage Bitcoin for their illicit activities. In this work, we propose back-and-forth exploration, a novel automated Bitcoin transaction tracing technique to identify cybercrime financial relationships. Given seed addresses belonging to a cybercrime campaign, it outputs a transaction graph, and identifies paths corresponding to relationships between the campaign under study and external services and other cybercrime campaigns. Back-and-forth exploration provides two key contributions. First, it explores both forward and backwards, instead of only forward as done by prior work, enabling the discovery of relationships that cannot be found by only exploring forward (e.g., deposits from clients of a mixer). Second, it prevents graph explosion by combining a tagging database with a machine learning classifier for identifying addresses belonging to exchanges. We evaluate back-and-forth exploration on 30 malware families. We build oracles for 4 families using Bitcoin for C&C and use them to demonstrate that back-and-forth exploration identifies 13 C&C signaling addresses missed by prior work, 8 of which are fundamentally missed by forward-only explorations. Our approach uncovers a wealth of services used by the malware including 44 exchanges, 11 gambling sites, 5 payment service providers, 4 underground markets, 4 mining pools, and 2 mixers. In 4 families, the relations include new attribution points missed by forward-only explorations. It also identifies relationships between the malware families and other cybercrime campaigns, highlighting how some malware operators participate in a variety of cybercriminal activities.
