Research On De-anonymization Technology Of Tor Illegal Users Based On Bitcoin Transaction Analysis

As the largest anonymous communication network at present,Tor not only protects the privacy of client communication,but also provides a hidden service mechanism on the network side.Since hidden service can hide the real address information of the server side,this facilitates criminals to engage in illegal activities.In the dark web space formed by the Tor hidden service,there are a large number of illegal activities and transactions such as drug and gun sales,hacking attacks,etc.,and Bitcoin is the main payment method for these illegal hidden service transactions.In order to effectively regulate Tor illegal activities and their transactions,it is of great significance to study the technology of de-anonymization Tor illegal users based on Bitcoin transaction analysis.Existing research work has proven that Bitcoin is not completely anonymous,and that both blockchain data traceability and network traffic analysis can be used to undermine the anonymity of Bitcoin users.However,to de-anonymize Bitcoin transaction users in Tor’s illegal hidden service,it is necessary not only to collect the Bitcoin addresses involved in Tor’s illegal transactions,but also to further associate these addresses with the user’s real identity information.In addition,the introduction of Bitcoin mixing service has confused the income and expenditure relationship of Bitcoin transactions,which posed a greater challenge for tracing these transactions.In view of the above problems,the research work of this thesis mainly includes the following three points:Firstly,a technology for de-anonymizing users of Bitcoin transactions in Tor’s illegal hidden service is proposed.Based on the distributed crawler to collect the Tor hidden service page data and extract the Bitcoin address,the SVM classifier is used to automatically identify ten major categories of illegal hidden service.The Bitcoin addresses of illegal hidden service are clustered employing the multi-input heuristic clustering algorithm,and the Bitcoin address collection of illegal transaction users is further formed by combining the Bitcoin historical transaction records.Through Bitcoin address wallet tag association and Bitcoin address social identity association,the de-anonymization of Tor illegal transaction users is finally realized.Experimental results on real network data verify the effectiveness of the method.Secondly,a technology for de-anonymizing users of Bitcoin transactions for Bitcoin mixing service is proposed.By analyzing the working principle of Chip Mixer and Wasabi Wallet mixing services,mining the implicit transaction characteristics such as Bitcoin address type,quantity and amount in the mixing transactions,and the identification and statistical analysis of the mixing transactions of the two Bitcoin mixing services from blockchain data are completed.On this basis,the Chip Mixer user mixing behavior is classified,and the correlation between the pre-mix and post-mix transactions is realized by using the nearest matching association method,so as to achieve the effect of de-anonymization.The experimental results show that the above work can well identify the two mixing transactions,and successfully correlate the pre-mix and post-mix transactions of some Chip Mixer users,which can provide support for tracing users’ real transaction chains.Thirdly,combining the above research results,the Tor illegal user de-anonymization system is designed and implemented,which can realize the collection of hidden service pages and blockchain data,the identification of illegal hidden services,the acquisition of illegal user Bitcoin addresses,and the de-anonymization and result display of Bitcoin transaction users,thus verifying and demonstrating the effectiveness of the above methods.In summary,this thesis studies and implements the technology of de-anonymization users of Bitcoin transaction in Tor illegal hidden service,and on this basis,designs and implements the Tor illegal user de-anonymization system.The research work can provide effective technical support for regulating Tor illegal activities and their transactions.