{"type":"ScholarlyArticle","title":"BitcoinHeist: Topological Data Analysis for Ransomware Prediction on the Bitcoin Blockchain","authors":[{"name":"Cuneyt G. Akcora","slug":"cuneyt-g-akcora","given":"Cuneyt G.","family":"Akcora","affiliation":"University of Manitoba , Canada"},{"name":"Yitao Li","slug":"yitao-li","given":"Yitao","family":"Li","affiliation":"Purdue University , USA"},{"name":"Yulia R. Gel","slug":"yulia-r-gel","given":"Yulia R.","family":"Gel","affiliation":"University of Texas at Dallas , USA"},{"name":"Murat Kantarcioglu","slug":"murat-kantarcioglu","given":"Murat","family":"Kantarcioglu","affiliation":"University of Texas at Dallas , USA"}],"abstract":"Recent proliferation of cryptocurrencies that allow for pseudo-anonymous transactions has resulted in a spike of various e-crime activities and, particularly, cryptocurrency payments in hacking attacks demanding ransom by encrypting sensitive user data. Currently, most hackers use Bitcoin for payments, and existing ransomware detection tools depend only on a couple of heuristics and/or tedious data gathering steps. By capitalizing on the recent advances in Topological Data Analysis, we propose a novel efficient and tractable framework to automatically predict new ransomware transactions in a ransomware family, given only limited records of past transactions. Moreover, our new methodology exhibits high utility to detect emergence of new ransomware families, that is, detecting ransomware with no past records of transactions.","doi":"10.24963/ijcai.2020/612","url":"https://ijcai.org/proceedings/2020/612","pdf":"https://ijcai.org/proceedings/2020/0612.pdf","markdown":"https://ijcai.org/proceedings/2020/612.md","bibtex":"https://ijcai.org/proceedings/2020/bibtex/612","volume":{"slug":"2020","title":"Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2020","url":"https://ijcai.org/proceedings/2020/","year":2020,"location":"Yokohama","dates":"January 2021 (postponed from 11-17 July 2020)","editors":"Christian Bessiere","isbn":"978-0-9992411-6-5","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2020"},"section":"Special Track on AI in FinTech","track":"Special Track on AI in FinTech","number":612,"pages":{"first":4439,"last":4445},"keywords":["AI for banking: AI for cryptocurrencies","AI for regulation: AI for financial crime detection","AI for lending: AI for blockchain"],"videos":[{"label":"Video","url":"https://videos.ijcai20.org/26907/file_26907.m3u8","length_sec":974,"provider":"hls"}],"references":[{"position":1,"raw":"[Abay et al., 2019] N. C. Abay, C.G. Akcora, Y.R. Gel, U.D. Is- lambekov, M. Kantarcioglu, and B. Thuraisingham. Chainnet: Learning on blockchain graphs with topological features. In IEEE ICDM, 2019.","title":"Chainnet: Learning on blockchain graphs with topological features","authors":"N C Abay, C G Akcora, Y R Gel, U D Islambekov, M Kantarcioglu, B Thuraisingham","year":"2019","venue":"IEEE ICDM","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Akcora et al., 2017] C. G. Akcora, Y. R. Gel, and M. Kantar- cioglu. Blockchain: A graph primer. arXiv preprint arXiv:1708.08749, pages 1-17, 2017.","title":"Blockchain: A graph primer","authors":"C G Akcora, Y R Gel, M Kantarcioglu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Androulaki et al., 2013] E. Androulaki, G. O. Karame, M. Roeschlin, T. Scherer, and S. Capkun. Evaluating user privacy in bitcoin. In IFCA, pages 34-51, 2013.","title":"Evaluating user privacy in bitcoin","authors":"E Androulaki, G O Karame, M Roeschlin, T Scherer, S Capkun","year":"2013","venue":"IFCA","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlsson, 2009] G. Carlsson. Topology and data. Bulletin of the American Mathematical Society, 46(2), 2009.","title":"Topology and data","authors":"G Carlsson","year":"2009","venue":"Bulletin of the American Mathematical Society","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen and Guestrin, 2016] T. Chen and C. Guestrin. Xgboost: A scalable tree boosting system. In 22nd ACM SIGKDD, pages 785-794, 2016.","title":"Xgboost: A scalable tree boosting system","authors":"T Chen, C Guestrin","year":"2016","venue":"22nd ACM SIGKDD","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Conti et al., 2018] M. Conti, A. Gangwal, and S. Ruj. On the economic significance of ransomware campaigns: A bitcoin transactions perspective. Computers & Security, 2018.","title":"On the economic significance of ransomware campaigns: A bitcoin transactions perspective","authors":"M Conti, A Gangwal, S Ruj","year":"2018","venue":"Computers & Security","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dingledine et al., 2004] R. Dingledine, N. Mathewson, and P. Syverson. Tor: The second-generation onion router. Technical report, Naval Research Lab, 2004.","title":"Tor: The second-generation onion router","authors":"R Dingledine, N Mathewson, P Syverson","year":"2004","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Ester et al., 1996] M. Ester, H.-P. Kriegel, J. Sander, and X. Xu. A density-based algorithm for discovering clusters in large spatial databases with noise. In ACM SIGKDD, volume 96, pages 226-231, 1996.","title":"A density-based algorithm for discovering clusters in large spatial databases with noise","authors":"M Ester, H.-P Kriegel, J Sander, X Xu","year":"1996","venue":"ACM SIGKDD","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Forgy, 1965] E. Forgy. Cluster analysis of multivariate data: efficiency versus interpretability of classifications. Biometrics, 21:768-780, 1965.","title":"Cluster analysis of multivariate data: efficiency versus interpretability of classifications","authors":"E Forgy","year":"1965","venue":"Biometrics","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Hernandez-Castro et al., 2014] J. Hernandez-Castro, E. Boiten, and M. Barnoux. The 2nd kent cyber security survey. Kent University reports, 2014. https://kar.kent.ac.uk/52891/.","title":"The 2nd kent cyber security survey","authors":"J Hernandez-Castro, E Boiten, M Barnoux","year":"2014","venue":null,"doi":null,"url":"https://kar.kent.ac.uk/52891/","internal_url":null},{"position":11,"raw":"[Ho, 1995] Tin Kam Ho. Random decision forests. In 3rd ICDAR, volume 1, pages 278-282 vol.1, 1995.","title":"Random decision forests","authors":"Kam Ho ; Tin, Ho","year":"1995","venue":"3rd ICDAR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Huang et al., 2018] D. Y. Huang, D. McCoy, M. M. Aliapoulios, V. G. Li, L. Invernizzi, E. Bursztein, K. McRoberts, J. Levin, K. Levchenko, and A. C. Snoeren. Tracking ransomware end-to-end. In Tracking Ransomware End-to-end, pages 1-12. IEEE, 2018.","title":"Tracking ransomware end-to-end","authors":"D Y Huang, D Mccoy, M M Aliapoulios, V G Li, L Invernizzi, E Bursztein, K Mcroberts, J Levin, K Levchenko, A C Snoeren","year":"2018","venue":"Tracking Ransomware End-to-end","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Karypis et al., 2000] M. Karypis, G. Steinbach, V. Kumar, and M. Steinbach. A comparison of document clustering techniques. In KDD Workshop on TM, volume 400, pages 525-526, 2000.","title":"A comparison of document clustering techniques","authors":"M Karypis, G Steinbach, V Kumar, M Steinbach","year":"2000","venue":"KDD Workshop on TM","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Lewis, 2018] J. Lewis. Economic impact of cybercrime -no slowing down. McAfee Report, (2), 2018.","title":"Economic impact of cybercrime -no slowing down","authors":"J Lewis","year":"2018","venue":"McAfee Report","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Li et al., 2020] Y. Li, U. Islambekov, C. Akcora, E. Smirnova, Y. R. Gel, and M. Kantarcioglu. Dissecting ethereum blockchain analytics: What we learn from topology and geometry of the ethereum graph? In SIAM SDM, pages 523-531, 2020.","title":"Dissecting ethereum blockchain analytics: What we learn from topology and geometry of the ethereum graph?","authors":"Y Li, U Islambekov, C Akcora, E Smirnova, Y R Gel, M Kantarcioglu","year":"2020","venue":"SIAM SDM","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liao et al., 2016] K. Liao, Z. Zhao, A. Doupé, and G.-J. Ahn. Behind closed doors: measurement and analysis of cryptolocker ransoms in bitcoin. In IEEE APWG Symposium on eCrime, pages 1-13, 2016.","title":"Behind closed doors: measurement and analysis of cryptolocker ransoms in bitcoin","authors":"K Liao, Z Zhao, A Doupé, G.-J Ahn","year":"2016","venue":"IEEE APWG Symposium on eCrime","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Martin et al., 2018] A. Martin, J. Hernandez-Castro, and D. Camacho. An in-depth study of the jisut family of android ransomware. IEEE Access, 6:57205-57218, 2018.","title":"An in-depth study of the jisut family of android ransomware","authors":"Martin","year":"2018","venue":"IEEE Access","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Maxwell, 2013] Greg Maxwell. Coinjoin: Bitcoin privacy for the real world. In Post on Bitcoin Forum, 2013.","title":"Coinjoin: Bitcoin privacy for the real world","authors":"Greg Maxwell","year":"2013","venue":"Post on Bitcoin Forum","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[McGinn et al., 2016] D. McGinn, D.and Birch, D. Akroyd, M. Molina-Solana, Y. Guo, and W. J. Knottenbelt. Visualizing dynamic bitcoin transaction patterns. Big data, 4(2):109-119, 2016.","title":"Visualizing dynamic bitcoin transaction patterns","authors":"D Mcginn, D Birch, D Akroyd, M Molina-Solana, Y Guo, W J Knottenbelt","year":"2016","venue":"Big data","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Meiklejohn et al., 2016] S. Meiklejohn, M. Pomarole, G. Jor- dan, D. Levchenko, K.and McCoy, G. M Voelker, and S. Sav- age. A fistful of bitcoins: characterizing payments among men with no names. In ACM IMC, pages 127-140, 2016.","title":"A fistful of bitcoins: characterizing payments among men with no names","authors":"S Meiklejohn, M Pomarole, G Jordan, D Levchenko, K Mccoy, G M Voelker, S Savage","year":"2016","venue":"ACM IMC","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Nakamoto, 2008] S. Nakamoto. Bitcoin: A peer-to-peer electronic cash system, 2008.","title":"Bitcoin: A peer-to-peer electronic cash system","authors":"S Nakamoto","year":"2008","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Narayanan and Möser, 2017] A. Narayanan and M. Möser. Obfuscation in bitcoin: Techniques and politics. arXiv preprint arXiv:1706.05432, 2017.","title":"Obfuscation in bitcoin: Techniques and politics","authors":"A Narayanan, M Möser","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Paquet-Clouston et al., 2019] M. Paquet-Clouston, B. Hasl- hofer, and B. Dupont. Ransomware payments in the bitcoin ecosystem. Journal of Cybersecurity, 5(1):tyz003, 2019.","title":"Ransomware payments in the bitcoin ecosystem","authors":"M Paquet-Clouston, B Haslhofer, B Dupont","year":"2019","venue":"Journal of Cybersecurity","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Ruffing et al., 2014] T. Ruffing, P. Moreno-Sanchez, and A. Kate. Coinshuffle: Practical decentralized coin mixing for bitcoin. In ESORICS, pages 345-364, 2014.","title":"Coinshuffle: Practical decentralized coin mixing for bitcoin","authors":"T Ruffing, P Moreno-Sanchez, A Kate","year":"2014","venue":"ESORICS","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Scaife et al., 2016] N. Scaife, H. Carter, P. Traynor, and K. R.B. Butler. Cryptolock (and drop it): stopping ransomware attacks on user data. In IEEE 36th ICDCS, pages 303-312, 2016.","title":"Cryptolock (and drop it): stopping ransomware attacks on user data","authors":"N Scaife, H Carter, P Traynor, K R B Butler","year":"2016","venue":"IEEE 36th ICDCS","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Swan, 2015] M. Swan. Blockchain: Blueprint for a new economy. O'Reilly Media, Inc., 2015.","title":"Blockchain: Blueprint for a new economy","authors":"M Swan","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Weber et al., 2019] M. Weber, G. Domeniconi, J. Chen, D. K. I. Weidele, C. Bellei, Tom Robinson, and C. E. Leiserson. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics. arXiv:1908.02591, 2019.","title":"Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics","authors":"M Weber, G Domeniconi, J Chen, D K I Weidele, C Bellei, Tom Robinson, C E Leiserson","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}