Abstract

Bitcoin offers pseudonymity in the form of cryptographic addresses. Even then we can make use of the transparency of its public transaction ledger to infer ownership patterns by using analytical techniques. In this paper, we empirically evaluate the effectiveness of heuristic based address clustering used for identifying entities which use the bitcoin network. In particular, we utilize the multi-input ownership heuristic and change address heuristic to build an ownership graph from actual blockchain transaction data. To construct the graph, we deal with a hybrid graph representation with two types of edges: one for inferred ownership, and the other for real transaction flows. Heuristics are assessed by applying graph metrics such as cluster size distribution, component analysis, and anomalously large clusters. Using a machine learning–based anomaly detection method, the Isolation Forest algorithm, we find over-clustering behavior and suspicious structural patterns that breach the heuristic assumptions. We have shown that heuristic based techniques can be used to effectively uncover ownership patterns in many situations, but they are vulnerable to over-clustering and false associations caused by privacy enhancing techniques like CoinJoin services.