BitcoinHeist: Topological Data Analysis for Ransomware Prediction on the Bitcoin Blockchain

1 Introduction

This decade has been marked with the rise of blockchain based

ledger that stores transactions between two parties without requiring a trusted central authority. On a blockchain, two unacquainted parties can create an immutable transaction that is permanently recorded on the ledger to be seen by the public. The first application of Blockchain has been the Bitcoin cryptocurrency [Nakamoto, 2008]. Bitcoin's success has ushered an age known as the Blockchain 1.0 [Swan, 2015], and there are over 1000 Blockchain based cryptocurrencies.

Bitcoin transactions can be created anonymously, and participation in the network does not require identity verification. A payment can be requested by delivering a public Bitcoin address (i.e., a short string) to a sender by using anonymity networks such as Tor [Dingledine et al., 2004]. This ease of usage and worldwide transaction availability of Bitcoin have been noticed by malicious actors. Pseudo-anonymity of cryptocurrencies has attracted the interest of a diverse body of criminals, transnational terrorist groups, and illicit users. Cryptocurrency related crime and criminal abuse of blockchain technologies are nowadays recognized as the fastest-growing type of cyber-crime [Lewis, 2018].

∗Contact Author

Using cryptocurrencies for ransomware payments appears to be substantially more prevalent than has been previously realized. As noted by Hernendex-Castro et al. [Hernandez-Castro et al., 2014], among the respondents to their survey, "the prevalence of the CryptoLocker ransomware seems much higher than expected. The proportion of CryptoLocker victims that claim to have agreed to pay the ransom to recover their files (41%) seems to be much larger than expected (3% was conjectured by Symantec, 0.4% by Dell SecureWorks)". Hence, understanding ransomware payments and their overall economic impact is an emerging challenge of critical societal importance.

There have been efforts to analyze the cryptocurrency transactions using various heuristics. For example, the "co-spending" heuristic" is based on the idea that all input addresses of a transaction must belong to the same person since private keys associated with those accounts are needed to sign the transaction inputs [Meiklejohn et al., 2016]). However, to our knowledge, none of the previous efforts has leveraged advanced data analytics based on topological and geometric concepts of the underlying blockchain transaction graph.

In this paper, our goal is to identify Bitcoin addresses that are used to store and trade Bitcoins gained through ransomware activities. To address this challenge, we propose a scalable data-driven Bitcoin transaction analytics framework that is substantially more effective in predicting ransomware payment related addresses, compared to the existing heuristic based approaches.

We can summarize the significance of our contributions:

• To the best of our knowledge, we are the first to introduce the machinery of topological and geometric data analytic tools not only to ransomware detection but to e-crime analysis on blockchain.
• We design six features that encode known Bitcoin transaction obfuscation patterns which exhibit high utility in predicting ransomware related activities.
• Using the ground truth data collected by various external studies, we show that the developed ransomware prediction approach based on the Topological Data Analysis (TDA) delivers substantially higher accuracy, compared to existing heuristic based and standard machine learning procedures.
• In addition to detecting new addresses associated with a known ransomware family, we show that our new methodology also exhibits high utility to detect the emergence of new ransomware families.

2 RelatedWork

The success of Bitcoin [Nakamoto, 2008] has also encouraged significant usage of cryptocurrencies for illegal activities. The earliest results aimed at tracking the transaction network to locate bitcoins used in illegal activities, such as money laundering and blackmailing (e.g., [Androulaki et al., 2013]), by using heuristics.

Bitcoin provides pseudo-anonymity; although all transactions are public by nature, user identification is not required to join the network. Mixing schemes (e.g., [Maxwell, 2013; Ruffing et al., 2014]) exist to hide the flow of coins in the network. Earlier research results have shown that some Bitcoin payments can be traced [Meiklejohn et al., 2016]. As a result, obfuscation efforts [Narayanan and M¨oser, 2017] by malicious users have become increasingly sophisticated.

In ransomware analysis, Montreal [Paquet-Clouston et al., 2019], Princeton [Huang et al., 2018] and Padua [Conti et al., 2018] studies have analyzed networks of cryptocurrency ransomware, and found that hacker behavior can help us identify undisclosed ransomware payments. Datasets of these three studies are publicly available.

Early studies in ransomware detection have used decision rules on amounts and times of known ransomware transactions to locate undisclosed ransomware (CryptoLocker) payments [Liao et al., 2016]. More recent studies are joint efforts between researchers and Blockchain analytics companies; Huang et al. [Huang et al., 2018] identify shared hacker behavior and use heuristics to identify ransomware payments. The authors estimate that 20,000 victims have made ransomware payments. However, these studies do not extract features nor build machine learning models to detect ransomware payments and families.

Feature extraction has been studied for ransomware detection in the software security domain. In software code analysis, Cryptolock inspects ransomware programs and their activity for malicious characteristics [Scaife et al., 2016]. In this line of work, studies on ransomware for mobile devices extract software code features to catch malicious programs (e.g., [Scaife et al., 2016]). However, these approaches mainly target ransomware detection before ransomware infects a system, and do not consider Bitcoin transactions. A more recent approach of [Weber et al., 2019] uses 166 custom designed features and applies graph convolutional networks to detect illicit transactions (not just ransomware). We report a performance comparison of our TDA-based tool regarding data given in [Weber et al., 2019] in Section 6, and show that it provides better performance compared to the graph convolutional network based approach.

Similar TDA improvements are reported in the literature. For example, Abay et al. achieve better prediction accuracy with TDA based Persistent Homology tools [Abay et al., 2019], and Li et al. achieve better anomaly detection accuracy with TDA based models [Li et al., 2020]. However, these works are aimed at price or price anomaly prediction.

3 Background and Preliminaries

3.1 Ransomware

Ransomware is a malware that infects a victim's data and resources, and demands ransom to release them. In two main types, ransomware can lock access to resources or encrypt their content. Besides computer systems, ransomware can also infect IoT and mobile devices [Martin et al., 2018]. Ransomware can be delivered via email attachments or web-based vulnerabilities. More recently, ransomware have been delivered via mass exploits. For example, CryptoLocker used Gameover ZeuS botnet to spread through spam emails. Once the ransomware is installed, it communicates with a command-and-control center. Although earlier ransomware used hard-coded IPs and domain names, newer variants may use anonymity networks, such as TOR, to reach a hidden command-and-control server.

3.2 BitcoinGraphModel

We consider a directed weighted graph G = (V,E,B) created from a set of transactions TX and input and output addresses in TX (see [Akcora et al., 2017] for a graph primer on Blockchains). On G, V is a set of nodes, and E ⊆ V × V is a set of edges. B = {Address,Transaction} represents the set of node types. For any node u ∈ V , it has a node type φ(u) ∈ B. For each edge eu,v ∈ E between adjacent nodes u and v, we have φ(u) ̸= φ(v), and either φ(u) = {Transaction} or φ(v) = {Transaction}. An edge e ∈ E represents a coin transfer between an address node and a transaction node. This heterogeneous graph model subsumes the homogeneous case (i.e., |B| = 1), where only transaction or address nodes are used, and edges link nodes of the same type. Here, we focus on the case where each address node is linked (i.e., input or output address of a transaction) via a transaction node to another address node. We use Γia and Γoa to refer to predecessors (in-neighbors) and successors (out-neighbors) of an address a, respectively.

4 Ransomware Detection and Prediction

In this paper, we state the following five questions to analyze ransomware behavior on the Bitcoin blockchain: 1 -Which features can we extract from the Bitcoin network to detect ransomware payments? 2 - Does a ransomware family (e.g., Cryptolocker) show the same behavior on the Bitcoin blockchain over time? 3 - How similar is the behavior of different ransomware operators on the Bitcoin blockchain? 4 - Can we detect Bitcoin ransom payments that are not reported to law agencies or Blockchain Data Analytics companies? 5 - Based on the information about existing ransomware families at a time, can we detect the emergence of a new ransomware on the Bitcoin blockchain?

To address questions 1 - 5 , we formulate two primary research problems: i) detecting undisclosed payments to addresses that belong to a known ransomware family and ii) predicting the emergence of a ransomware family unknown to the date. We start by stating the notations used in our problem definitions.

Let {au}u∈Z+ be a set of addresses, and let each address au be associated with a pair (⃗xu, yu), where ⃗xu ∈ RD is a vector of its features and yu is its label. Depending on a setting, yu can designate a white (i.e., non-ransomware) address or a ransomware address. We associate timestamp tu to represent the earliest time when the address au appeared in a blockchain transaction. An address can appear in Bitcoin multiple times. Let f1, . . . , fn be labels of known ransomware families which have been observed until time point t. We set f0 to be the label of addresses which are not known to belong to any ransomware family and we assume them to be white addresses. Before time point t, if we observe l addresses a1, . . . , al, then we form their D × l-matrix of features Xt = {⃗x1, . . . ,⃗xl} and a vector of labels Yt = {y1, . . . , yl} ∈ {f0, f1, . . . , fn}.

We formally define our research problems:

Problem 1 [Existing Family Detection]: Let rs be a known ransomware family of interest. Let ˜ Yt ⊆ Yt be such that ∀yj ∈ ˜ Yt, yj ∈ {f0, frs} and ˜Xt ⊆ Xt be the corresponding matrix of features. (If at time t, ˜ Yt ∩{frs} = ∅, increase t such that ˜ Yt contains at least one frs). Let {al+1, . . . , al+z} be a set of addresses whose set of labels Yt′ = {yl+1, . . . , yl+z} is unknown, and let Xt′ = {⃗xl+1, . . . ,⃗xl+z} be a set of their corresponding observed features. Let t′ > t, and t < min{tal+1 , . . . , tal+z }. The problem is to predict all addresses am ∈ {al+1, . . . , al+z} such that ym = frs, using their available set of features Xt′ and history (Xt, Yt). Problem 2 [New Family Prediction]: Let rs′ be a new, yet unob-

served ransomware family, and frs′ be its label. Let (Xt, Yt) be a pair of the sets of features and labels, respectively, such that at time point t, ∀yj ∈ Yt, yj ̸= frs′. Let {al+1, . . . , al+z} be a set of addresses whose set of labels Yt′ = {yl+1, . . . , yl+z} is unknown, and let Xt′ = {⃗xl+1, . . . ,⃗xl+z} be a set of their corresponding observed features. Let t′ > t, and t < min{tal+1 , . . . , tal+z }. The problem is to predict all addresses am ∈ {al+1, . . . , al+z} such that ym /∈ {f0, f1, . . . , fn} and am is associated with the new ransomware rs (i.e., ym = frs′), using their available set of features Xt′ and history (Xt, Yt).

5 Methodology

To solve each of our two research problems, we use four existing (baseline) methods and propose a fifth solution based on Topological Data Analysis that achieves the best results. In this section, we will outline these methods. We start by discussing our features.

5.1 Graph Features

On the heterogeneous Bitcoin network, the in-neighbors Γin of a transaction txn is defined as the set of transactions (not addresses) whose one or more outputs are input to transaction txn. The out-neighbors of txn are denoted as Γon. A transaction has inputs and outputs; the sum of output amounts of a transaction txn is defined as Ao(n) = ∑ au∈Γon Aou(n), where an output address au

receives Aou(n) coins.

On the Bitcoin network, an address may appear multiple times with different inputs and outputs. An address u that appears in a transaction at time t can be denoted as atu. To mine address behavior in time, we divide the Bitcoin network into 24 hour long windows by using the UTC-6 timezone as reference. This window approach serves two purposes. First, the induced 24 hour network allows us to capture how fast a coin moves in the network. The speed is measured by the number of blocks in the 24 hour window that contains a transaction involving the coin. Second, temporal information of transactions, such as the local time, has been found useful to cluster criminal transactions (see Figure 7 in [Huang et al., 2018]).

On the heterogeneous Bitcoin network, in each snapshot we extract the following six features for an address: income, neighbors, weight, length, count, loop.

Income of an address u is the total amount of coins output to u: Aou(n).

Neighbors of an address u is the number of transactions which have u as one of its output addresses: ∣∣Γiu∣∣.

We define the next four address features by using their time ordered position in the defined 24 hour time window. We denote time of a window with the earliest time t of transactions in it. For each window, we first locate the set of transactions that do not receive outputs from any earlier transaction within the studied window t, i.e., TX = {∀txn ∈ TX, s.t., Γin = {at0 1 , . . . , atn z }, t0 ≤ tn < t}. These transactions consume outputs of transactions that have been generated in previous windows. For simplicity, we refer to a transaction tx ∈ TX as a starter transaction.

Weight of an address u, Wu, is defined as the sum of the fraction of coins that originate from a starter transaction and reach u. Each output address u of a transaction txn receives 1/Γon coins, regardless of the amount Aou(n). Note that weight is oblivious to the transacted amount. This design makes the weight feature robust against obfuscation that uses big coin flows to many other addresses.

Length of an address u, Lu, is the number of non-starter transactions on its longest chain, where a chain is defined as an acyclic directed path originating from any starter transaction and ending at address u. A length of zero implies that the address is an output address of a starter transaction.

Count of an address u, Cu is the number of starter transactions which are connected to u through a chain, where a chain is defined as an acyclic directed path originating from any starter transaction and ending at address u.

Loop of an address u, Ou is the number of starter transactions which are connected to u with more than one directed path.

Rationale: We designed graph features to quantify specific obfuscation patterns used by ransomware operators:

Loop counts how many transactions i) split their coins; ii) move these coins in the network by using different paths and finally, and iii) merge them in a single address. Coins at this final address can then be sold and converted to fiat currency (see Figure 7 in [McGinn et al., 2016] for examples of such patterns).

Weight quantifies the merge behavior (i.e., the transaction has more input than output addresses), where coins in multiple addresses are each passed through a succession of merging transactions and accumulated in a final address (see aggregations in Figure 1 of [Huang et al., 2018] for an application of this pattern).

Similar to weight, we design the count feature to quantify the merging pattern. However, the count feature represents information on the number of transactions, whereas the weight feature represents information on the amount (what percent of these transactions' output?) of transactions.

Length quantifies mixing rounds [Maxwell, 2013] on Bitcoin, where transactions receive and distribute similar amounts of coins in multiple rounds with newly created addresses to hide the coin origin (see the mixing rounds in Figure 2 of [Ruffing et al., 2014]).

5.2 BaselineMethods for Ransomware Prediction

Naive Similarity Search (1): We use addresses in a specific time window t and compute pairwise Cosine similarity [Karypis et al., 2000] to known ransomware addresses from past l days.

Heuristics: The following heuristics [Meiklejohn et al., 2016] are used in our experimental evaluation. Co-spending heuristic

(2A): "If two addresses are inputs to the same transaction, the same user controls them". Transition heuristic (2B): "If we observe one transaction with addresses A and B as inputs, and another with addresses B and C as inputs, then we conclude that A, B, and C all belonged to the same user".

Clustering - DBSCAN (3A): DBSCAN is a density-based non-parametric clustering algorithm. DBSCAN can mark outlier points that lie alone in low-density regions as noise [Ester et al., 1996].

Clustering - Hierarchical (3B): We use k-means clustering with Forgy based initial seed selection on address feature vectors [Forgy, 1965].

Extreme Gradient Boosting Trees (4A): XGBT applies gradient boosting algorithms to decision trees [Chen and Guestrin, 2016].

Random Forest (4B) is a supervised ensemble of multiple simple decision trees [Ho, 1995].

5.3 TDAMapper for Ransomware Analysis

We now introduce the concepts of Topological Data Analysis (TDA) into detection of ransomware patterns on Bitcoin. The fundamental idea of TDA is to extract hidden data patterns via systematic analysis of data shapes such as, cycles and flares, quantified at various resolution scales [Carlsson, 2009].

The key idea behind Mapper is the following. Let U be a total number of observed addresses and {⃗xu}Uu=1 ∈ RD be a data cloud of address features. Select a filter function ξ : {⃗xu}Uu=1 → R. Let I be the range of ξ, that is, I = [m,M] ∈ R, where m = minu ξ(⃗xu) and M = maxu ξ(⃗xu). Now place data into overlapping bins by dividing the range I into a set S of smaller overlapping intervals of uniform length, and let uj = {u : ξ(⃗xu) ∈ Ij} be addresses corresponding to features in the interval Ij ∈ S. For each uj perform a single linkage clustering to form clusters {ujk}.

As a result, Mapper produces a low dimensional representation of the underlying data structure in the form of a "cluster tree"

Algorithm 1 TDA filtering with multiple attributes.

Input: A set of networks CT 1, . . . , CT D; filter threshold q; inclusion threshold ϵ1; size threshold ϵ2; set of past ransomware addresses RS; set of past non-ransomware addresses NRS. Output: A set of suspicious

addresses.

• 1: P : Map ← Initialize scores of all l addresses with 0. 2: for cluster Cc ∈ CT do 3: Ac ←select all addresses in Cc 4: V ←Ac ∩RS 5: if |V | ≥ ϵ1 × |RS| then 6: if |Ac| ≤ ϵ2 × |CT .V | then 7: for au ∈ Ac \ {RS ∪ NRS} do 8: Pu ← 1 + Pu 9: qt ←quantile(P, q) 10: return {∀au ∈ P|Pu ≥ qt}

graph CT where each "cluster" is a branch of some single connected component rather than a disconnected component on its own as in conventional clustering analysis. In Figure 1, we show an example of the produced Mapper graph. Each node may contain three sets of addresses: past RS addresses, past non-RS addresses, and addresses of the current time window, whose labels are unknown. If current addresses are contained in clusters that also contain many past known ransomware addresses, by association, we deem these current addresses potential ransomware addresses.

We filter the TDA mapper graph by using each of our six graph features. As a result, we get six filtered graphs CT 1, . . . , CT 6 for each time window. Afterwards, we assign a suspicion, or risk score to an address au (see Algorithm 1).

Algorithm 1 starts by computing the number of past ransomware addresses in each cluster. If both inclusion and size thresholds, ϵ1 and ϵ2, respectively, are satisfied, addresses in the cluster have their suspicion scores incremented.

Parameters. We use two parameters to control what we learn from mapper clusters: inclusion and size parameters. The inclusion parameter ϵ1 limits what can be learned when very few ransomware addresses are contained in the cluster. The size threshold ϵ2 prevents learning when cluster includes too many addresses. Such phenomenon usually happens if a filtering feature does not exhibit a sufficiently discriminating performance during a specific time window, and all addresses are lumped together. We further use a quantile threshold q on addresses, and label addresses suspicious only if they are in the top 1 - q of all addresses. We emphasize that by controlling q, ϵ1 and ϵ2 parameters, we can avoid making predictions when evidence of past ransomware is not sufficiently strong.

We denote TDA models with the TDAϵ1|ϵ2 q notation. TDA models may deliver nested results; for example TDA0.5|ϵ2 q may return the same set of suspicious addresses as TDA0.7|ϵ2 q results. For such cases, we prefer the most restrictive model; i.e., the model with the highest q, highest ϵ1 and lowest ϵ2.

Main idea: By observing the intrinsic topology and geometry of the blockchain transaction graph, Mapper allows for recovering of hidden similarities between "clusters", or groups of addresses, that are typically unavailable with traditional clustering techniques. If an address appears in attribute filtered clusters with known ransomware addresses frequently, it is more likely to be a ransomware address itself.

6 Ransomware Detection and Prediction

Dataset. We have downloaded and parsed the entire Bitcoin transaction graph since its beginning in 2009. Using a time interval of 24 hours, we have extracted daily transactions on the network and formed the Bitcoin graph. For computational efficiency, we have filtered out the network edges that transfer less than B0.3, since ransom amounts are rarely below this threshold.

Metrics and Parameters. We compute accuracy by using overall sums of TN, FN, FP and TP values across multiple time windows as (TP +FN)/(P +N). In all models, we report the optimal parameters that maximize F1 scores in predictions: In DBSCAN, we experimented with ϵ = 0.05, . . . , 1 values. Random Forest uses ntree=500 and mtry=|Xt| /3. XGBoost uses the gbtree booster and nrounds = 25. For TDA computations, we use the TDAMapper RStats package (https://github.com/paultpearson/TDAmapper) with parameters overlap=40 and interval = 80.

6.1 Existing Family NewAddress Detection

Given features and known labels of past addresses Xt,Yt at time t and features of addresses Xt′ at time t′ > t, we train for existing ransomware family detection:

1. Select a ransomware family rs whose new addresses will be detected at time t′ .
2. For t < t′ , use a training length l, and create a dataset Xt which holds features and labels of addresses observed between times t - l and t.
3. Create an f0 sample of size N from X0 [t-l,t] ⊆ X[t-l,t] without replacement where ∀xu ∈ X0 [t-l,t] , yu = f0 and N = ∣∣∣X0 [t-l,t]∣∣∣.
4. Create a ransomware sample of size N from Xrs [t-l,t] ⊆ X[t-l,t] without replacement where ∀xu ∈ Xa
5. [t-l,t] , yu = frs and N ≤ ∣∣∣Xrs [t-l,t]∣∣∣.
6. Using the ground truth data at t′ , find all ransomware addresses for t′: Xrs t′ .
7. Using the ground truth data at t′ , take a sample of M = 1000 white (i.e., f0) addresses without replacement: X0 t′ .
8. Remove past known addresses from Xrs t′ , i.e., Xrs t′ ←Xrs t′ \Xrs [t-l,t] .
9. Use features {X0 [t-l,t] ∪Xrs [t-l,t]} and labels {Y 0 [t-l,t] ∪Y rs [t-l,t]} as the training data, and classify {X0 t′ ∪Xrs t′ }.

We emphasize four aspects of existing family detection: i) from the test dataset we remove appearances of addresses that have appeared in the past (i.e., t < t′), since we already know their labels, ii) if an address appears in multiple windows, its each appearance has (potentially) different features in X[t-l,t] with the same rs label, iii) on many days, we do not have N past rs addresses to train from, iv) Most importantly, we learn a model for each ransomware family. In our analysis, we show that these models do not share the same characteristics.

Heuristics. Using co-spending and transition heuristics with all history (i.e., N = |Xt|, and l = ∞), we discover only 40 unique addresses from CryptoLocker (Padua), CryptoWall (Padua), CryptoTorLocker2015 (Montreal), CryptoTorLocker2015 (Padua) families.

Authors of the three datasets that we adopt had already considered heuristics. Since the creation of these datasets, there have been very few addresses that are involved in transactions by past ransomware addresses.

Table 1 shows the main results of our models. Gain is defined as improvement of accuracy over the next best model (i.e., Gain = 100×(AccTDA-Accbase)/Accbase); in CryptoLocker and CryptoWall this model is DBSCAN. Naive Cosine similarity search is the best baseline model in Locky and CryptXXX families. For each ransomware family, TDA has a hyper-parameter set that produces the best model. These parameter values are not the same across families. Sample size (N) and training length (l) parameters are different. For each family, we also provide the best non-TDAmodel for comparison. The CryptoLocker ransomware has the best TDA gain result with an improved accuracy of 213.8%. In Table 1, #w is the number of windows where a model makes at least one label prediction. By using the q, ϵ1 and ϵ2 hyper-parameters, TDA models avoid predicting labels when the level of confidence in the derived classification is low.

Similar to TDA, DBSCAN can ignore data points in clustering, and DBSCAN yields two of the best non-TDA results. In the best TDA models for each ransomware family, we predict 16.59 FP for each TP (lower is better). This number is 27.44 for the best non-TDA models.

Other approaches. The Elliptic dataset study [Weber et al., 2019] detects illicit transactions by using a Graph Convolutional Network, but Random Forests (RF) achieves higher accuracy. The Elliptic dataset does not disclose how each feature is generated nor provides the actual transactions or addresses used in transactions. Hence, we could not generate the features used in our study to compare utility of the features we have proposed. However, similar to our approach, the authors have divided the network into (50) time periods, and have used the latest periods as the test data. We applied our TDA approach to the Elliptic dataset by using the 166 features found in [Weber et al., 2019] to detect illicit transactions and to understand the relative performance of our TDA tool. We have found that our TDA-based approach has detected 322 TP vs. 362 in RF in windows 40, 41 and 42, but correctly detected up to six times more TP transactions (14 vs 131 tp) in periods 43, . . . , 50. In particular, in four of the last seven windows TDA

can detect illicit transactions, but RF cannot detect any.

6.2 NewFamily Prediction

Given features Xt and known labels Yt of past addresses at time t and features of addresses Xt′ at time t′ > t, we now train for discovering addresses belonging to new ransomware families:

1. For t < t′ , use a training length l, and create a dataset X[t-l,t] ⊆ Xt which holds features of addresses observed between windows t - l and t.

2. Create an f0 sample of size N from X0

replacement where ∀xu ∈ X0

1. Create a ransomware sample of size N from Xrs [t-l,t] ⊆ X[t-l,t] without replacement where ∀xu ∈ Xrs [t-l,t] , yu ̸= f0 and

[t-l,t] ⊆ X[t-l,t] without

[t-l,t] , yu = f0 and N = ∣∣∣X0

5. By using the ground truth data at t′ , take a sample of M=1000 white addresses without replacement to be used in the testing phase: X0 t′ .

6. By using the ground truth data, choose a family rs′ whose emergence at t′ will be discovered.

7. By using the ground truth data at t′ , find all ransomware addresses for t′ to be used in the testing phase: Xrs′ t′ .

8. Use features {X0 [t-l,t] ∪Xr [t-l,t]} and labels {Y 0 [t-l,t] ∪Y r [t-l,t]} as the training data, and classify {X0 t′ ∪Xr t′ }.

We emphasize two aspects in predicting a new family: i) in training, addresses of all existing families are relabeled with fr, creating a unified ransomware class, ii) when an address is predicted as ransomware, we cannot immediately claim whether it makes up a new family or belongs to an existing family. As our current goal is to predict new ransomware families with no prior information about these families, the training task has to learn a single model that will identify all future ransomware families. Using our models, we forecast the emergence of 25 ransomware families. Emergence of the first ransomware, CryptoLocker, cannot be predicted since we have no prior data to train a model.

The best model, TDA0.05|0.35 0.7 uses N = 1K past samples, l = 120 training length, and predicts TP = 26,FN = 8,TN = 5032,FP = 21075. The model predicts 25 emerging ransomware families, but also results in 810.57 FP for each TP. We hypothesize that this performance is because of data scarcity in training; among the 25 families, only three families have more than one address in their first window on the Bitcoin blockchain. These families are DMALockerv3 (2016/day 233), Flyper (2016/335) and eRanger (2016/68).

We repeat the forecasting experiment by considering the earliest window when a ransomware uses ten or more addresses. Such filtering results in a dataset of five RS families. We exclude

[t-l,t]∣∣∣.

the previously observed addresses of these families from our training set. The first and the identified earliest windows for each family are presented in Table 2. Time difference in windows is as small as one day for some families.

Table 3 shows the main results of our models. We define gain as improvement of accuracy over the next best model (i.e., Gain = 100 × (AccTDA - Accbase)/Accbase). We find that three variations of TDA models deliver the best F1 results for all five families. Besides TDA models, we show one competing result from other models for each family. Overall, in three families TDA has the highest accuracy value. We reach the best result for CryptXXX, where a TDA model predicts 1 TP and 1 FP. With the best models provided in Table 3, on average we predict 27.53 FP for each TP in forecasting of new ransomware families.

We emphasize that for some families, such as CryptXXX, our models predict only two ransomware addresses, one of which is a TP. This result offers evidence that our prediction models tend to be highly effective for certain families of ransomware. These results also show that we can detect addresses from an emerging RS by using information from previously detected ransomware addresses. Finally, such findings imply that RS operators tend to behave similarly, which may indicate a shared origin between RS families.

7 Conclusions

We have proposed a new framework to detect and predict ransomware payments on Bitcoin using the advanced data analytic machinery of Topological Data Analysis. The new TDA-based tool has substantially improved the ransomware detection accuracy, compared to existing approaches.

As a future research direction, we plan to extend the proposed topological and geometric methodology to mapping entities to IP addresses in geographical locations.

Acknowledgements

Akcora has been partially supported by the NSERC Discovery Grant RGPIN-2020-05665. Gel has been partially supported by NSF DMS 1925346, IIS 1633331, NSF DMS-1736368 and ECCS 1824716. Kantarcioglu has been partially supported by NIH 1R01HG006844, NSF CICI-1547324, and IIS-1633331.