Identification and Analysis of Ransomware Transactions in the Bitcoin Network

Abstract

The advent of Blockchain and its subsequent application in creating Bitcoin has changed the world of finance. The peer-to-peer Blockchain networks, lack a third-party intermediary authority to regulate the transactions, making it vulnerable to various forms of stings. One of the most proliferate uses of crypto transactions is for the ransom payment made by victims of ransomware attacks. Owing to the varied nature of the ransomware attacks, coupled with the decentralized nature of Blockchain, tracking and guarding against such attacks is still a challenge. One way to prevent ransomware attackers from easily benefitting from such crypto transactions is to identify them and avert any payment to those attackers. In this paper, the impact of three ensemble classification algorithms – Random Forest, XGBoost and Balanced Bagging are studied to correctly classify ransomware payments from existing Bitcoin transaction data, to identify the attackers’ addresses and possibly suspend them from taking part in any transactions. The outcomes of the three algorithms are compared with each other based on various indicators. From the experimental results, it could be concluded that Balanced Bagging Classifier demonstrated better performance with an accuracy of 98.41%.