This paper demonstrates the use of network analysis to identify core nodes associated with ransomware attacks in cryptocurrency transaction networks. The method helps trace the cyber entities involved in cryptocurrency attacks and supports intelligence efforts to identify and disrupt cryptocurrency networks. A data corpus is built by the unsupervised machine learning graph algorithm ‘DeepWalk’ . DeepWalk evaluates the position of nodes within networks. It compares the relative position of different nodes (similarity) and identifies those whose removal would most affect the network (riskiness). This method helps identify on the blockchain the key nodes that are involved in the execution of a ransomware attack. When applied to the ransomware “cash out” graph, the method derived “riskiness” scores for specific nodes. Analysing the derived “riskiness” at a community level (groups of nodes in the network) provides an enhanced granularity for identifying and targeting influential nodes. Such insight could potentially support both intelligence and forensics investigations.
|Title of host publication||Proceedings of the 54th Hawaii International Conference on System Sciences | 2021|
|Place of Publication||Honolulu|
|Publisher||University of Hawaii at Manoa|
|Number of pages||13|
|Publication status||Published - 5 Jan 2021|
|Event||Hawaii International Conference on System Sciences (54th : 2021) - Honolulu, United States|
Duration: 5 Jan 2021 → 8 Jan 2021
|Conference||Hawaii International Conference on System Sciences (54th : 2021)|
|Period||5/01/21 → 8/01/21|
Bibliographical noteVersion archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.