Follow the money: revealing risky nodes in a Ransomware-Bitcoin network

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contributionpeer-review

211 Downloads (Pure)


This paper demonstrates the use of network analysis to identify core nodes associated with ransomware attacks in cryptocurrency transaction networks. The method helps trace the cyber entities involved in cryptocurrency attacks and supports intelligence efforts to identify and disrupt cryptocurrency networks. A data corpus is built by the unsupervised machine learning graph algorithm ‘DeepWalk’ [1]. DeepWalk evaluates the position of nodes within networks. It compares the relative position of different nodes (similarity) and identifies those whose removal would most affect the network (riskiness). This method helps identify on the blockchain the key nodes that are involved in the execution of a ransomware attack. When applied to the ransomware “cash out” graph, the method derived “riskiness” scores for specific nodes. Analysing the derived “riskiness” at a community level (groups of nodes in the network) provides an enhanced granularity for identifying and targeting influential nodes. Such insight could potentially support both intelligence and forensics investigations.
Original languageEnglish
Title of host publicationProceedings of the 54th Hawaii International Conference on System Sciences | 2021
Place of PublicationHonolulu
PublisherUniversity of Hawaii at Manoa
Number of pages13
ISBN (Print)9780998133140
Publication statusPublished - 5 Jan 2021
EventHawaii International Conference on System Sciences (54th : 2021) - Honolulu, United States
Duration: 5 Jan 20218 Jan 2021


ConferenceHawaii International Conference on System Sciences (54th : 2021)
Abbreviated titleHICSS-54
CountryUnited States

Bibliographical note

Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.


  • Ransomware
  • Bitcoin
  • Intelligence


Dive into the research topics of 'Follow the money: revealing risky nodes in a Ransomware-Bitcoin network'. Together they form a unique fingerprint.

Cite this