Abstract:Exploiting the anonymous mechanism of Bitcoin, ransomware activities demanding ransom in bitcoins have become rampant in recent years. Several existing studies quantify the impact of ransomware activities, mostly focusing on the amount of ransom. However, victims’ reactions in Bitcoin that can well reflect the impact of ransomware activities are somehow largely neglected. Besides, existing studies track ransom transfers at the Bitcoin address level, making it difficult for them to uncover the patterns of ransom transfers from a macro perspective beyond Bitcoin addresses. In this article, we conduct a large-scale analysis of ransom payments, ransom transfers, and victim migrations in Bitcoin from 2012 to 2021. First, we develop a fine-grained address clustering method to cluster Bitcoin addresses into users, which enables us to identify more addresses controlled by ransomware criminals. Second, motivated by the fact that Bitcoin activities and their participants already formed stable industries, such as Darknet and Miner , we train a multi-label classification model to identify the industry identifiers of users. Third, we identify ransom payment transactions and then quantify the amount of ransom and the number of victims in 63 ransomware activities. Finally, after we analyze the trajectories of ransom transferred across different industries and track victims’ migrations across industries, we find out that to obscure the purposes of their transfer trajectories, most ransomware criminals (e.g., operators of Locky and Wannacry) prefer to spread ransom into multiple industries instead of utilizing the services of Bitcoin mixers. Compared with other industries, Investment is highly resilient to ransomware activities in the sense that the number of users in Investment remains relatively stable. Moreover, we also observe that a few victims become active in the Darknet after paying ransom. Our findings in this work can help authorities deeply understand ransomware activities in Bitcoin. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal activities that have similarly adopted bitcoins as their payments.

Machine learning-based ransomware classification of Bitcoin transactions

Ransomware Classification and Detection With Machine Learning Algorithms

Classification of ransomware families with machine learning based on N-gram of opcodes.

Application of Explainable Machine Learning in Detecting and Classifying Ransomware Families Based on API Call Analysis

Blockchain security for ransomware detection

Ransomware Detection and Classification Strategies

Ransomware Detection: Leveraging Sandbox, Text Mining Techiques and Machine Learning

Ransomware detection based on machine learning using memory features

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

Ransomware Detection and Classification Using Random Forest: A Case Study with the UGRansome2024 Dataset

XRAD: Ransomware Address Detection Method based on Bitcoin Transaction Relationships

BigRC-EML: big-data based ransomware classification using ensemble machine learning

Data-Centric Machine Learning Approach for Early Ransomware Detection and Attribution

Ransomware threat mitigation through network traffic analysis and machine learning techniques

Crypto-ransomware detection using machine learning models in file-sharing network scenario with encrypted traffic

Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms

Ransomware Analysis using Feature Engineering and Deep Neural Networks

A few-shot meta-learning based siamese neural network using entropy features for ransomware classification

A Large-scale Empirical Analysis of Ransomware Activities in Bitcoin

A comprehensive analysis combining structural features for detection of new ransomware families

Federated Learning Approach for Distributed Ransomware Analysis