中国科学院自动化研究所机构知识库

随着加密货币技术的发展及其使用范围的扩大，加密货币正在改变传统货币、商品、服务和资本的存储与交易方式，推动了全球经济的虚拟化变革。近年来，加密货币被逐步视为一种新兴的金融资产，其价格变动带来短期造富和投资损失，引发了局部金融安全事件。一系列影响加密货币系统自身结构和使用加密货币的网络犯罪，引发了多起安全事件。因此，面向加密货币展开分析，去研究并理解加密货币，探索与其密切相关的安全风险和防范措施，具有十分重要的研究和应用价值。

加密货币的交易记录是公开可得的，货币价格的相互影响、交易记录可进一步构建为网络，因此借鉴复杂网络理论和分析方法加深对加密货币的理解成为一个重要的研究思路。现有的研究多针对少数几种货币展开分析，面向整个加密货币市场特征及微观交易网络的研究尚不深入。本论文探索如何利用复杂网络理论和分析方法挖掘加密货币的特点，并服务于安全领域应用。具体地，论文融合传统金融市场基于相关性的网络分析、复杂网络分析中网络度量和拓扑特性、网络表示学习方法，探索宏观加密货币市场、微观交易网络、微观用户网络的特性，加深对加密货币的理解，进一步提出比特币交易网络中的目标交易地址识别算法，并探索其在安全风险和处置方面的应用。

本论文的主要研究内容与贡献包括：

(1)将传统金融市场中基于相关性的网络分析方法应用于加密货币市场的研究。论文选取~50~种代表性的加密货币，从货币价格变化入手，首先验证经典分析手段关联矩阵和资产树可用于加密货币市场，然后，以此为分析工具，在实验的基础上，提取五个分析角度来表征加密货币市场，从宏观整体层面理解加密货币交易市场的本质。论文首次从金融市场层级研究加密货币，并将其与外汇和股票两个较为成熟的传统金融市场进行对比，发现虽然加密货币的设计目标是作为去中心化的数字货币使用，但其动态性却与股票市场更相似，而且比股票市场更脆弱。

(2)将分析复杂网络的度量指标和拓扑特征应用于加密货币交易网络的研究。加密货币交易记录具有公开可得性和自然的网络结构，论文选取比特币、域名币、以太坊三种代表性的加密货币，面向微观交易网络，研究其拓扑结构特征及演化规律。针对加密货币交易网络，论文通过实证分析首次发现：1)与大多数复杂网络不同，加密货币交易网络的增长并不总是服从稠密化定律和恒定平均度假设，其度分布不服从经典的幂律分布；2)交易网络中节点和边的存活率都很低，故传统以累积网络为对象的分析并不能揭示加密货币的动态演化特征，论文通过实验，选取月度动态网络为进一步研究和分析的对象，探索了加密货币的动态演化规律；3)不同货币表现出不同的网络属性，比特币和以太坊交易网络的节点均是重尾分布和异配连接，但只有比特币交易网络可视为经典意义上的小世界网络。

(3)基于网络表示学习，提出比特币交易网络中的目标交易地址识别算法。加密货币的匿名性和去中心化，使其在洗钱和走私等违法交易中得到大规模的应用，造成极大的安全隐患和风险。不同于传统的基于用户身份映射的反匿名研究，论文提出一种新的基于用户交易模式的研究思路，将反匿名问题转为目标交易地址的识别。论文以比特币为研究对象，将交易地址按应用场景分为典型的四类，包括特定类别的交易地址（交易所、赌场、服务）和一般交易地址，利用统计方法分析这些交易地址的可识别性，然后使用网络表示学习方法提取特征，在类别不平衡的条件下训练多分类器，进行特殊地址的识别。论文提出的算法容错率高，可实现大规模应用，识别出的目标交易地址，能为网络安全相关的应用提供基础。

With technological development and wider use, cryptocurrencies have changed the way currencies, goods, services, and capitals are stored and exchanged, and promote the virtualization of the global economy. In recent years, cryptocurrency has gradually been regarded as an emerging financial asset, and its price changes have brought short-term wealth creations and investment losses, causing systemic financial risks. In addition, a series of cyber crimes affecting the structure of cryptocurrency systems or from the use of cryptocurrency has led to numerous security incidents. Therefore, it is of great importance to analyze the cryptocurrency and explore its security applications. 

Cryptocurrency transaction records are publicly available, both the interaction between different cryptocurrency prices and transaction records can be further represented as a network. Thus one of the potential ideas of cryptocurrency analysis is to take advantages of complex network analysis to understand the cryptocurrency. Existing studies mainly focus on a few cryptocurrencies, and the researches on the characteristics of the whole cryptocurrency market and the micro transaction network are not yet in-depth. This thesis explores how to apply the complex network theory and analysis methods to explore the characteristics of the cryptocurrency and serve the security applications. Specifically, based on correlation-based network methods, network metrics and topological characteristics, and network representation learning, this thesis explores characteristics of macro cryptocurrency market, micro transaction network and the user network to deepen the understanding of cryptocurrency, further proposes targeted addresses identification for Bitcoin and explores its application in security risk and disposal.

The main researches and contributions of this thesis include:

(1)Apply correlation-based network analysis in the traditional markets to the research of the cryptocurrency market. We select 50 representative cryptocurrencies, based on the macro currency price changes, firstly verify that the correlation matrix and asset tree can be applied to analyze the cryptocurrency market, then we extract five properties to characterize the cryptocurrency market. Our work is the first to study the cryptocurrency market from the financial market level and compares it with two traditional financial markets (currencies, stocks). It is found that although cryptocurrency was built initially as a possible implementation of digital currency, its dynamics are more similar to the stock market and are more fragile. Apply typical network metrics and topological characteristics to study the topological structure and evolution of the micro transaction network. 

(2)Transaction records are publicly available and have a natural network structure. This is the first empirical comparison among three cryptocurrencies, i.e., Bitcoin, Namecoin and Ethereum, and has following foundings: 1) The growth pattern of transaction networks do not always follow neither the densification law nor the constant average degree, and its degree distribution cannot be well fitted by the classical pow-law distribution. 2) The survival ratio of nodes and edges in the transaction network is very low. Therefore, a monthly network is proposed as an appropriate object to understand the dynamics of the network. 3) Different cryptocurrencies exhibit different network properties, e.g., Bitcoin and Ethereum networks are heavy-tailed with disassortative mixing, however, only the former can be treated as a small world. 

(3)Based on network representation learning, we propose targeted addresses identification algorithm in Bitcoin transaction network. The anonymity and decentralization of cryptocurrency make it widely used in illegal transactions such as money laundering and smuggling, causing great security risks. Different from the traditional de-anonymity approach based on user identities, this thesis proposes targeted addresses identification based on user's transaction mode. We divide addresses into four types, exchange, gambling, service, and general. We first use statistical methods to analyze the identifiability, then use DeepWalk to extract features and train multi-classifiers under imbalance condition to classify addresses in the transaction network. The algorithms increase the fault-tolerant rate and have a wide range of applications, and the identified target addresses can provide the foundation for security-related applications.