Evaluation of Crypto Assets Investigation Techniques: Bitcoin Address Clustering
摘要
Blockchain analysis is essential during investigations of crypto assets such as Bitcoin; however, one of the challenges faced during investigations is the grouping of addresses controlled by the same user. To solve this problem, various techniques known as clustering heuristics have been proposed by past studies. In this study, we investigate the existing heuristic methods (H1 to H5) used in clustering of Bitcoin addresses, find their precision, recall, and overall accuracy percentage, and contribute an additional heuristic (H6) that is understudied. The additional heuristic will help in improving the prediction of change addresses. The study employed a controlled experiment, in which we manually conducted 43 Bitcoin transactions using multiple Bitcoin wallets. This created the ground truth data that enabled the precise calculation of each heuristic’s accuracy. The results from the controlled experiment showed average accuracy levels of all six heuristics were 89.6% with multi-input, rounded payment, and combined inputs to cover larger outputs, performing well in normal transactions. However, they were affected when privacy-enhancing techniques were applied. Our contribution heuristic was the most applicable in most transactions if they had been spent. The findings concluded that no single heuristic was stronger than the others; they all needed to be complemented by others in the prediction of change output. The study recommends that law enforcement agencies use a multi-heuristic approach when clustering Bitcoin addresses.